Cybersecurity consulting services for companies: controls and vendors with no bias
Protecting the operation starts with knowing what to protect. We help decide which controls the company needs and choose cybersecurity solutions and vendors with criteria defined before seeing proposals.
What does an independent cybersecurity consultant do?
It helps you decide what to protect, with which controls and with which vendors, before buying a tool. We start from what is already in production, take public frameworks as references (NIST CSF 2.0, ISO/IEC 27001) and have no vendor commissions. The scope is selection and governance: defining controls, choosing vendors and governing the implementation; day-to-day operation is delivered by the selected vendor.
Risk assessment
Inventory of what supports the operation, what depends on what and where today's risks are, before recommending a tool.
Four criteria
Functional, technical, economic and sustainable: it covers the risks found, integrates with what exists, the budget covers operating it, and it grows with the company.
Scope
Definition of controls, selection of solutions and vendors, and support through contracting. Implementation is managed with our Project Management (PMO).
Cybersecurity
01Risk assessment
Inventory of what supports the operation, what depends on what and where today's risks are, before recommending a tool.
02Controls and architecture
Identities, devices, monitoring and incident response: which controls cover the risks found and in what order.
03Vendor selection
Comparison of solutions and vendors with the same four criteria of every selection: functional, technical, economic and sustainable.
Cybersecurity is decided with the same logic as the rest of the infrastructure: first what supports the operation and which risks exist today, then which controls cover them, and only at the end which tool or vendor. Buying the tool before knowing what to protect is, in our view, the costliest mistake.
The NIST Cybersecurity Framework 2.0, published in February 2024, organizes cybersecurity outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. It is designed for organizations of all sizes and sectors and does not prescribe how to achieve each outcome; that is why it serves as a public reference to structure the assessment without tying it to a vendor.
With the assessment organized by Functions, we define the criteria before requesting proposals — what the solution must cover, what it must integrate with, what it costs to operate and how it grows with the company — and compare vendors for identity protection, devices, monitoring and incident response with the same four criteria of every selection: functional, technical, economic and sustainable.
If a customer or the sector requires ISO/IEC 27001 certification, the international standard for information security management systems, the assessment is aligned with its requirements from the start, and leadership prepares with the ISO 27001 course at Leadership Academy. Certification is not mandatory to protect the operation; knowing which controls exist and who answers for them is.
Cybersecurity is part of the business continuity plan: controls reduce the likelihood of the incident, and the continuity plan defines how the company keeps operating if it happens. Implementation of the chosen solutions is governed by our Project Management (PMO).
This selection is part of the Identify phase within the full CIRA Method
“We don't just help our clients choose technology solutions — we help them make decisions that strengthen and transform their organization.”
What comes after you choose
Before choosing a cybersecurity vendor, read this
Frequently asked questions
When the company has proposals from several vendors and no criteria to compare them; when a customer, a bank or a regulator requires controls or ISO/IEC 27001 certification; after an incident; or when it migrated to the cloud and the old controls no longer apply.
We evaluate specific vendors and solutions — identities, devices, monitoring and response — with the same four objective criteria we use in every selection, and with no vendor commissions.
They are complementary. NIST CSF 2.0 is a public, non-prescriptive framework to understand, assess and prioritize cybersecurity risks in organizations of any size; ISO/IEC 27001 defines the requirements for an information security management system and allows certification. Which one guides the assessment depends on whether the company needs to certify (Cyrrus's view).
The scope is defining the controls, selecting the solutions and vendors, and governing the implementation with the PMO. Day-to-day operation is delivered by the selected vendor; we define what it must meet and how it is measured.
Cybersecurity controls reduce the likelihood of an incident; the continuity plan defines how the company keeps operating if it happens. They are designed together: the business impact analysis (BIA) says what to protect first.
Have another question?
Ready to connect the decision to the execution?
Tell us your organization's challenge. We'll set up a conversation with the right team and tell you straight whether we can help.
Not sure where to start? Request a free diagnostic session