Understand exposure. Build resilience that can be demonstrated.
Security decisions need a clear view of what matters, what could fail and which controls work in practice. I connect technical findings with management responsibility and a realistic improvement plan.
For leaders, security and IT teams reviewing risks, preparing assurance evidence or strengthening the continuity of important services.
Four questions behind a credible security position.
01
What must remain protected?
Identify important services, information and dependencies. Clarify the assessment boundary, relevant threats and the impact of disruption on the organisation.
An agreed scope and a prioritised view of exposure.
02
What does the evidence show?
Review governance, controls, records and available test results. Distinguish documented intentions from implemented measures and evidence that they operate effectively.
Findings linked to evidence, gaps and assessment limitations.
03
How ready is the organisation?
Examine detection, escalation, response, recovery and supplier dependencies. Assess whether responsibilities and continuity arrangements are sufficiently clear and practicable.
A resilience assessment with operational weaknesses and priorities.
04
What should change first?
Prioritise measures by risk, urgency and feasibility. Assign owners and define the evidence needed to verify completion or support a risk-acceptance decision.
An actionable plan with ownership and verification criteria.
Concrete outputs, agreed to fit the question.
An assessment of security governance, controls and material risks.
Evidence-linked findings with explicit limitations.
A review of continuity, recovery and critical dependencies.
A prioritised improvement plan and verification criteria.
NIS2 · ISO/IEC 27001 · NIST CSF 2.0
Relevant requirements, standards and frameworks.
NIS2 operates through national requirements, including Croatia’s Cyber Security Act. ISO/IEC 27001 is a management-system standard; NIST CSF 2.0 is a cyber risk framework. CER concerns broader resilience of critical entities where applicable. We establish the relevant scope before using these references; a review does not itself certify compliance.
Official reference points
These sources provide context. Applicability and current requirements are checked for the specific engagement.
My experience combines ICT leadership, information security management and more than 50 expert engagements concerning cybercrime, security incidents and ISMS. Published qualifications include ISO/IEC 27001 Master and ISO/IEC 27032 Senior Lead Cybersecurity Manager. Personal qualifications do not certify a client organisation.
Describe the service, concern and decision ahead without including credentials or sensitive incident records. We can agree a suitable assessment scope and a direct channel for confidential evidence.
A clear starting point The first conversation clarifies your problem, the intended outcome, the available evidence and the possible scope of work. We agree the next step together.