01
Fractional CISO
Security strategy, board reporting and budget planning without the cost of a full‑time CISO.
- Strategy and roadmap
- Board reporting
- Policies and procedures
We run cybersecurity from the boardroom to the server room.
We work in two disciplines: information security consulting that builds how your organisation manages security, and technical cybersecurity that tests your defences the way an attacker would. Every engagement aims at the same outcome: measurably lower risk.
01
Information security and risk management
We strengthen cyber resilience, build a risk‑based security culture and make security part of management decisions.
02
ISO/IEC 27001 ISMS
We build your ISMS with you, from scoping to the certification audit. With lead‑auditor experience, we know the auditor’s questions in advance.
- Gap analysis
- Risk assessment and Statement of Applicability
- Internal audit and management review
03
ISO 22301 business continuity
Business impact analysis, continuity plans and exercises that keep critical processes running during disruption.
- Business impact analysis
- Continuity and crisis plans
- Tabletop exercises
04
Regulatory compliance
We combine GDPR, NIS2, Turkish KVKK and Cybersecurity Law 7545, and sector regulators’ expectations into one control framework.
- Compliance gap analysis
- Control mapping
- Audit readiness
05
Supplier risk management
We make third‑party risk measurable with standard assessments and the IQ Portal risk score.
- Supplier tiering
- Assessment questionnaires
- Security clauses in contracts
06
Awareness programmes
Role‑based training and phishing simulations turn a yearly compliance session into a measured programme.
- Annual awareness plan
- Phishing campaigns
- Executive briefings
02
Technical cybersecurity
We test your defences with real attacker techniques and turn the findings into a prioritised, practical remediation plan.
01
Penetration testing
Clearly scoped tests with readable reports for web applications, APIs, external and internal networks, cloud and wireless.
- OWASP and PTES methodology
- Executive summary and technical report
- Retest
02
Security operations (SOC)
We review log sources, detection rules and incident response processes and raise their maturity.
- SIEM use cases
- Incident response plan
- CSIRT processes
03
Threat intelligence
We monitor threats to your sector and brand and give early warning on leaked credentials and look‑alike domains.
- Brand and domain monitoring
- Leak scanning
- Threat reports
04
Security audits
We audit configuration, access rights and hardening of critical systems against recognised benchmarks.
- CIS Benchmarks
- Access reviews
- Finding tracking
05
OT / SCADA security
Network segmentation, secure remote access and operator awareness for ports, energy and manufacturing.
- IEC 62443 approach
- Asset inventory
- Remote access controls
06
Cloud security
Identity, email and configuration security in Microsoft 365, Azure and AWS.
- M365 security assessment
- MFA and conditional access
- SPF, DKIM, DMARC
Approach
Standards and regulations we work with
We design controls so that one control set satisfies several requirements at once.
- 01
Teknogirişim Badge holder
We clarify goals, competitors and keywords together.
- 02
Republic of Türkiye Ministry of Industry and Technology, 2026
Alternative design drafts; we build once you approve.
- 03
Development
Fast, secure, tested code, content and SEO included.
- 04
Launch and growth
Go‑live, training and monthly reports.
Frequently asked questions
What is a fractional CISO and who is it for?
A fractional CISO is an experienced security leader who takes on the CISO role part‑time or on set days. It suits mid‑sized companies that do not yet need a full‑time CISO but must report on security to the board, prepare for audits or meet regulatory requirements.
How long does ISO 27001 certification take?
It depends on your current maturity and scope. For many mid‑sized organisations, preparation takes from a few months up to a year. Our initial gap analysis gives you a realistic timeline.
What do I receive after a penetration test?
A risk‑focused summary for management and a detailed technical report with evidence, impact and a remediation recommendation for every finding. A retest to confirm fixes is included.
Can you support companies in Germany and Türkiye at the same time?
Yes. We work from Stuttgart and Istanbul and report in English, German and Turkish. For companies operating in both countries, we bring GDPR and KVKK requirements together in one structure.
Do I have to buy consulting together with IQ Portal?
No. Consulting and IQ Portal are available separately. Used together, awareness and supplier metrics show the progress of the consulting work with hard data.
