How to choose your outsourced CISO firm?
8 essential criteria to select the cyber partner that will support your organization for 3 to 5 years.
Recognized certifications
Check both firm-level and individual certifications: ISO 27001 LI/LA, CISSP, CISM, EBIOS RM, PASSI (ANSSI).
Sector experience
The firm must have real experience in your industry (healthcare HDS, finance DORA, critical-operators NIS2).
Digital platform
Modern cyber steering requires an integrated GRC platform for asset register, risks, incidents, indicators.
SLA and responsiveness
Check availability commitments (24/7 on-call?), intervention delays and escalation procedures.
Contractual clauses
Liability, cyber professional insurance, GDPR sub-processor clauses, means vs results commitment.
Communication quality
Regular reporting, executive briefings, popularization for boards. A good CISO also knows how to dialog with the business.
Verifiable references
Ask for concrete case studies, testimonials from similar companies and ideally a chat with a reference customer.
Compatible company culture
The CISO will be your strategic counterpart for 3 to 5 years on average: human fit is essential.
Checklist: 5 questions to ask in interviews
- Can you present 2 missions similar to my sectoral context?
- What is the exact profile of the CISO who will be dedicated to our account?
- How do you handle continuity if the consultant leaves?
- What is your GRC steering platform and can I try it?
- What are your SLA commitments and how do you measure your performance?
Une méthodologie éprouvée, alignée sur les référentiels
Nous appliquons les standards reconnus (ISO 27001, EBIOS RM, NIST CSF, ANSSI) et adaptons notre accompagnement à vos enjeux sectoriels : banque, assurance, santé, industrie, services, public.
Un expert dédié
Votre interlocuteur unique, présent à chaque COPIL et disponible en cas de crise.
Méthodologie cadrée
Livrables standardisés, planning explicite, points réguliers — vous savez où vous en êtes.
Sectoriel adapté
Banque, santé, industrie, public : on adapte les mesures à vos obligations spécifiques.
Disponibilité
Assistance réactive, gestion de crise, accompagnement lors des contrôles des autorités.
Référentiels appliqués dans nos missions