Service · IT & Digital
Cybersecurity & Identity Management
Attackers need one open door. You must know them all.
Identifying security risks and implementing organisational and technical measures, including identity and access management. The result is documented risks, implemented measures and tested incident processes; certification is issued by accredited bodies.
Usual
What you often get
A penetration test, a long list of findings, and then nothing happens. Or an ISMS built from templates that mainly exists for the audit. When it matters, someone is hunting for the provider's phone number at night.
IntoOps
What you get from us
Whatever a test finds, we fix too, together with our cloud & infrastructure team. The ISMS grows out of how you actually operate, not out of templates. And your team rehearses the emergency with us before it happens.
Service components
6 components. Where a licence is required, we coordinate.
Marked components require a licence, so they always come as part of a wider engagement. Licensed partners carry them out; we appoint them on your behalf and coordinate.
-
Finding vulnerabilities in systems, applications and processes.
-
ISMS to ISO 27001 or NIS2 requirements; certification by accredited bodies.
Note: Certification and conformity assessment are carried out by accredited certification bodies or notified bodies. We appoint them on your behalf and coordinate.
-
Accounts, roles, single sign-on and multi-factor authentication.
-
Protecting devices, networks and email.
-
Training and phishing simulations for employees.
-
Response plans, exercises and support during incidents.
What you'll have at the end. Results you can check.
- A risk list with a rating, measure, owner and deadline for each item.
- A test report with vulnerabilities, fixes and a retest showing what's closed.
- A roles and permissions concept with multi-factor sign-in for every account.
- An incident handbook with reporting lines and a log of the last exercise.
- An ISMS with policies and evidence, ready for an accredited body's audit.
- Training records and phishing simulation results, without exposing individuals.
When you need this. And how you'll know.
- An important contract suddenly depends on proof of security, and you have none.
- You don't know whether NIS2 applies to you and what follows from it.
- Former staff accounts are still active, and nobody has an overview of permissions.
- There was an incident, and afterwards nobody was sure who should have done what.
Rarely alone. Never bundled.
Cybersecurity & Identity Management often works together with these services. We'll tell you honestly when a combination makes sense, and when it doesn't.
Shows up in these initiatives.
You don't need a whole initiative to get Cybersecurity & Identity Management. These examples show where the service is often needed.
Good questions. Straight answers.
Can you certify us to ISO 27001?
No. Only accredited bodies issue certificates, and that's how it should be. We build the ISMS, prepare the audit, appoint the body on your behalf and support you through the assessment.
Do you help with NIS2 obligations?
Yes, with implementation: risk management, reporting lines, evidence and technical measures. Whether your company falls under NIS2 is a legal question. For that, we bring in a law firm through compliance & risk management.
Can we commission just a penetration test?
Yes. You get a report with vulnerabilities and recommendations, ranked by urgency. Your own team or provider can fix them, or we take that on and test again afterwards.
Will you help if we're attacked?
Yes, if we've agreed it beforehand. Then availability, reporting line and contact person are in the contract, and the plan has been rehearsed. Without an agreement, we check case by case whether and how fast we can step in.
Isn't good antivirus software enough?
No. Many attacks start with stolen credentials, a fake email or a forgotten account. What helps against them is multi-factor sign-in, clean permissions, training and updates.
If you like, our IT operations & support team can handle the updates on an ongoing basis.
Proof first. Contract second.
In the free Initiative Check, we listen for 45 minutes and ask the questions that usually only come up after the contract is signed. Then you get a short written assessment: what we see, how we would go about it and roughly what it would take.
No obligation. And if we're not the right fit, we'll tell you.
Or write to us at hello@intoops.com.