Cybersecurity consulting for large enterprises and groups

In corporates we fill the CISO function as a vCISO mandate at a project-based daily rate. Every mandate follows the same methodology. It is built into OdySecure, the platform our vCISO works with, with multi-entity support and consolidated group reporting.

The platform operates on a 4-role model (admin / owner / reviewer / user) and separates central group governance from decentralised site execution. A single control catalogue serves multiple standards in parallel (ISO 27001, NIS-2, IEC 62443, DORA, TISAX). Reports are generated at three levels: group report for board and supervisory board, site report for local management, working report for operational security leadership. Multilingual user interface (DE/EN) from module launch.

Evidence is built on reproducible audit trails: every control answer, every measure and every piece of evidence is documented with timestamp, owner and versioning. The methodology aligns with ISO 27001, IEC 62443 and BSI IT-Grundschutz. Evidence can be exported from the platform for internal audit, external auditors, certification bodies and regulatory reviews.

Three scenarios are typical: Co-existence: Cybervize as the specialised module for cybersecurity standards, while the existing GRC suite continues to cover enterprise risk management. Gradual replacement: migration over 12 to 18 months with parallel operation and data takeover. Full replacement: for groups looking to modernise their GRC investment and unhappy with licence and implementation costs of the legacy suite. Cybervize supports API integration with existing ITSM and SIEM systems.

The group report delivers on demand: (1) maturity heatmap by site and standard, (2) top-10 risks with mitigation status, (3) measure tracking by owner and due date, (4) compliance status for NIS-2, DORA, ISO 27001 and sector-specific requirements, (5) 12-month trend charts. Format: PDF templates for supervisory-board sessions, interactive dashboard for ongoing oversight. Language: DE/EN. KPI-driven, free of consulting jargon.

Currently supported: ISO 27001:2022, NIS-2 (with sector-specific minimum measures), DORA (financial sector), IEC 62443 (OT and industrial security), TISAX (automotive), BSI IT-Grundschutz, KRITIS regulation, NIST CSF. The underlying architecture works with a shared control mapping: answering a control once applies it to every parallel standard. Extensions follow market demand (Cyber Resilience Act, EU AI Act, NIS-2 sector expansions).

Corporates without their own CISO fill the function through the vCISO mandate: a senior CISO runs the ISMS and the evidence across every company in the group, the OdySecure platform with its corporate modules is included, and billing is on a project-based daily rate. Corporates with their own CISO license the platform on its own, with an onboarding project of 6 to 12 months handed over to your internal team if you wish. If you only need to bridge a vacancy, the Interim CISO is the better fit, with no platform dependency.

Three models. vCISO mandate: we fill the CISO function, the platform is included, billed on a project-based daily rate. Platform licence on its own for organisations with their own CISO: annual licence, scaled by digitally connected people and modules, not by headcount. Interim CISO for vacancies: typically €8,000 to €15,000 a month, project-based, no platform dependency. Entry prices are on the pricing page; the corporate quote is calculated per project and under NDA.