Interim CISO, fractional CISO or permanent hire: which model fits?
Effective CISO support depends on the mandate. Urgency, leadership need, decision rights and the intended outcome determine the right model.
Read article →Executive Insights
Perspective for executives, IT and security leaders.
Concise executive perspectives on security leadership, regulation and resilience—with a clear decision question and a practical management checklist.
Executive perspective
Complex subjects. Clear consequences.
These articles support management decisions. They do not replace an organisation-specific assessment.
NIS2 across corporate groups: separating scope, accountability and evidence
A group-wide security model does not remove entity-level obligations. NIS2 readiness needs clear accountability, dependencies and evidence.
Read article →ISO 27001 ISMS roadmap: from scope and risk to credible audit readiness
An effective ISMS is more than a policy set. It connects scope, risk, controls, accountability and evidence generated through routine operation.
Read article →Securing OT supplier remote access: governance before technology
Remote maintenance is necessary in many industrial environments. Without controlled identities, approval, segmentation and monitoring, it becomes a critical attack path.
Read article →A cyber risk register for boards: turning findings into decisions
An effective cyber risk register translates technical findings into business scenarios, clear ownership and defensible management decisions.
Read article →Incident response tabletop exercises: turning plans into decision capability
A tabletop exercise reveals whether roles, escalation, communication and recovery work under pressure without putting live operations at risk.
Read article →Which cybersecurity decisions genuinely belong in the boardroom
Not every technical gap is a board matter. Business risk, trade-offs and resource commitment are the decisive filters.
Read article →NIS2: From obligation lists to effective governance
Readiness does not come from more spreadsheets. It comes from connecting accountability, risk, control and evidence.
Read article →Recovery is not a backup question. It is a management capability
A successful backup does not show which business service will operate again in time under real dependencies.
Read article →Next step
Which decision can no longer remain open?
Define the security need without obligation, or discuss the situation directly with Matthias Totzauer.