What happened, what I decided and what changed. No names where they can't be shared, numbers where they exist.
Certification and voluntary NIS2 in an industrial group
Italian industrial group with three sites, more than a hundred active construction sites and OT networks; large customers that audit the security of their suppliers.
The group needed a recognised certification and credible answers to customer audits; NIS2 did not apply to it.
One system of controls and evidence serving ISO/IEC 27001, the NIS2 measures and customer audits together, instead of three separate projects; maturity measured against the NIST Cybersecurity Framework.
ISO/IEC 27001 certification achieved; NIS2 measures voluntarily adopted at Tier 3 (Repeatable); the same evidence underpins the security audits customers run on the group, including one by a large international industrial group.
Forensic acquisition of a cloud tenant
A company needed to preserve the data of a corporate cloud environment in a defensible way.
A plain copy is not evidence: the acquisition had to withstand a challenge.
Acquisition under ISO/IEC 27037, with a documented chain of custody and a data processing agreement (GDPR Art. 28) in place before touching anything.
Evidence acquired and verifiable, with full documentation handed to the client.
Governing an MDR and paying the right price
About 300 endpoints to cover with a managed detection and response service, under a clear mandate from leadership: spend as little as possible without lowering the bar.
The initial offer was out of line with that mandate.
Defined the scope and service level actually needed, then negotiated the contract; the service stays under my direction, including detection tuning and escalation.
-45% on the annual cost, at the vendor's highest service tier.