Security and Preparedness

Security is a management discipline. The threat landscape shifts quickly, and boards, customers and European regulators expect security work that is systematic, documented and embedded in corporate governance. NIS2, the GDPR and ISO/IEC 27001 set the framework, but it is management priorities, the governance system and the organisation's ability to handle incidents that determine whether a business is genuinely resilient.

Under Security and Preparedness, Berigo brings together the services that build this capability: CISO as a Service, ISO 27001 certification and Incident Preparedness and Response. Together they cover the full span from strategic security leadership and documented governance to practised, operational incident response.

What we deliver

• CISO as a Service: Senior security leadership at board and executive level: security strategy, governance framework, risk reporting and continuous improvement, without the cost and effort of building an in-house department.
• ISO 27001 certification: Complete programmes from baseline assessment and gap analysis to an established ISMS, internal audit and support through the external certification audit. The goal is genuine security improvement, not a paper exercise.
• Incident preparedness and response: Notification plans, contingency frameworks, exercises and structured incident handling with post-incident review, so the organisation responds quickly and in a controlled manner when something happens.
• Risk and compliance: Risk and vulnerability assessments, NIS2 readiness and reporting that gives the board and executive team an up-to-date basis for decisions.

Who it is for

We work with organisations in both the private and public sectors, with particular experience from energy, industry, maritime, finance, technology and critical infrastructure. The services are relevant for entities within the scope of NIS2, for companies facing security and certification requirements from customers and tenders, and for organisations that need executive-level security expertise without a full-time CISO.

How an engagement typically starts

A typical engagement begins with a no-obligation, confidential conversation in which we map the current state, maturity, regulatory requirements and level of ambition. We then propose a structure, scope and pace tailored to the organisation, whether that means an ongoing CISO function, a certification programme or strengthened incident preparedness. The work is anchored with executive management from day one, and knowledge transfer is an integral part of the delivery: the goal is for the organisation to own its own security work.