What we can do for your organisation
Every engagement starts from a risk analysis and a simple question: what must keep working, whatever happens?
CISO as a Service
The role of Chief Information Security Officer, performed by an external professional who already holds it in organisations subject to NIS2. It is designed for those who need a credible security lead but do not have the size or the need to hire one full time.
The service is also delivered in collaboration with Momit Srl, when continuous oversight and technical tools are needed.
- Security strategy and multi-year plan approved by senior management
- Risk analysis and treatment, with criteria the board can read
- Policies, procedures and roles, without unnecessary bureaucracy
- Supply chain security: qualification and monitoring of ICT suppliers
- Periodic reporting to management bodies
- Relations with authorities, auditors and certification bodies
NIS2 and the National Cyber Security Perimeter
Legislative Decree 138/2024 transposed the NIS2 Directive in Italy and brought new obligations for thousands of essential and important entities. We follow them from the inside, with a CISO working in an essential entity that is also included in the Perimeter, and from the outside, as consultants.
Entities added in 2026: the timetable →
The goal is not “having the documents”, but being able to show at any time that the measures are applied and that the management bodies have approved them and follow them.
- Applicability check and correct registration on the ACN platform
- Gap analysis against the baseline security measures
- Compliance plan with priorities, owners and deadlines
- Incident notification procedures to CSIRT Italia, tested before they are needed
- Mandatory training for management bodies
- Platform to manage obligations, risks and evidence over time
Incident management and exercises
An incident is handled well if it has already been rehearsed. For operational response we work with specialist partners (CSIRT as a Service with Momit Srl, incident response with Cloud Security Italia Srl). For preparation we run dedicated exercises.
War Room exercises last three hours and can also be held remotely. They put the crisis committee in front of realistic scenarios, such as a double-extortion ransomware attack or a compromise of OT systems that started from a supplier. The clock for NIS2 notifications really runs, and participants vote on decisions from their own phones.
- Incident response plan and escalation procedures
- War Room exercises with a written debriefing and improvement plan
- Support to senior management during the incident: decisions, communication, notifications
- Post-incident analysis and lessons learned
- Business continuity and disaster recovery plans (ISO 22301)
DPO and personal data protection
We act as Data Protection Officer (DPO) (Art. 37–39 GDPR) and support controllers that are not required to appoint one but must still demonstrate their compliance.
The advantage of entrusting privacy and security to someone who knows both is that technical measures, impact assessments and data breach management finally speak the same language.
- DPO appointment, also combined with the CISO role
- Record of processing activities, privacy notices, appointment of processors
- Data protection impact assessments (DPIA) and privacy by design
- Data breach management procedure coordinated with the NIS2 incident procedure
- Whistleblowing reporting channels (Legislative Decree 24/2023), see below
Reporting channel and external manager
Legislative Decree 24/2023 requires companies with at least 50 employees, those in regulated sectors and those with a 231 model to have an internal reporting channel, managed by an autonomous party. We provide the platform, act as external manager and prepare the procedure, privacy notices and impact assessment.
- Encrypted platform, with a separate key for each company
- Appointment as external manager, with a substitute for conflicts of interest
- Procedure, privacy notices, DPIA and note to the trade unions
- Acknowledgement within 7 days and feedback within 3 months kept under control
ISO management systems
We design management systems that stand on their own: few documents, clear processes, indicators that help decide. We integrate them with each other and with legal obligations, so that the same work serves certification, NIS2 and the GDPR.
- ISO/IEC 27001, information security, and the ISO/IEC 27002, 27017, 27018, 27701 guidelines
- ISO 22301, business continuity
- ISO/IEC 20000-1, IT service management
- ISO/IEC 42001, artificial intelligence management systems
- ISO 31000, risk management
- ISO 9001 and integrated systems
Audit and assessment
With an ISO/IEC 27001 Lead Auditor we carry out internal and second-party audits, including the audits on critical suppliers required by NIS2. For vulnerability assessments and penetration tests we rely on technical partners, and we take care of how they are set up and how the results are read.
- Internal audits on management systems
- Second-party audits on ICT suppliers
- Security maturity and NIS2/GDPR compliance assessments
- Coordination of vulnerability assessments and penetration tests
Training
Giacomo Pesce is a qualified ISO/IEC 27001 trainer for certification and training bodies such as DNV and Kiwa, and also teaches courses on process improvement and Lean Six Sigma methodology.
For companies we design tailored programmes, from management bodies to operational staff.
- ISO/IEC 27001 auditor and lead auditor courses
- NIS2 training for management bodies
- Security awareness for all staff
- Risk management (ISO 31000) and business continuity (ISO 22301)
- Lean and continuous process improvement
Regulated sectors
In some sectors cybersecurity comes from several regulations at once, national, European and sector-specific. We line them up and build a single system that meets them all, without duplicating what is already in place.
- ISPS port facilities: MIT Circular 177/2025, cyber annex to the PFSA, CyPFSO role from 26 November 2026, training of staff with security duties
- Automotive supply chain: UN R155, ISO/SAE 21434, TISAX, NIS2 and Cyber Resilience Act
- Food and beverage: NIS2, critical entities, security of production lines and the cold chain, Machinery Regulation
- Healthcare: hospitals, health authorities, private facilities and pharmaceuticals, with NIS2, critical entities, health data and medical devices
- Products with digital elements: Cyber Resilience Act, classification, vulnerability handling and reporting
Digital forensics
Acquisition and analysis of digital evidence for companies, law firms and individuals, with methods that preserve its integrity and the chain of custody.
We only accept private-party engagements, not appointments by the judicial authority.
- Forensic acquisition of devices, mailboxes and cloud accounts
- Analysis following incidents, fraud or internal breaches
- Expert reports for a private party
Where to start?
Tell us in a few lines about your organisation and what worries you. We will tell you honestly whether and how we can help.