For SMEs
Cybersecurity for small and medium-sized companies
Small and medium-sized companies make up 99 percent of businesses in the European Union, yet cybersecurity rules and advice often treat them like corporations. We help build security to scale: without a security department, without unnecessary tools, whether or not the law requires it.
When to start
- A client requires evidence of security.
- The company is growing and nobody is formally responsible for security.
- You do not know whether KSC, NIS2 or the CRA apply to you.
- You want to put security in order before an incident happens.
How we work with SMEs
In proportion
We match safeguards to real risk and scale, not beyond need.
No large project
We start with a 2.5-day readiness review. You get a list of gaps and a 90-day plan.
You pay for what you need
Modular implementation, or a package of consulting hours if you prefer to do part of the work yourself.
Independent of vendors
We do not sell licences or hardware.
Your own security lead
The Cybersecurity Management Academy prepares someone from your team for this role.
Ongoing support
The Basic tier for smaller organisations with a simple IT environment.
See the readiness review, implementation, ongoing support and the Academy.
ShieldNet
ShieldNet grew out of our work with smaller organisations. We built it and are handing it over to the ShieldNet Foundation as our contribution to making security accessible to every organisation. We base our own information security management system on it.
A voice for smaller organisations
In public consultations, national and European, we argue for requirements in proportion to scale and risk. See our positions and analyses for SMEs.
Regulations
If a regulation applies to you, compliance should follow from the security programme rather than be a separate project. See our approach to compliance.
Frequently asked questions
An incident does not depend on legal status, and clients increasingly require evidence of security. We start from risk, not from regulations.
Yes. The review is based on conversations with key people and on actual practice.
We do not start with tools. Without a risk analysis it is hard to justify which ones are needed.
Yes. In that case we offer a package of consulting hours.
Let us talk about the security of your organisation
You do not need to be ready for a large project. A conversation about where you are and what the law requires of you is enough. We will help you plan realistic, workable steps.
- contact@isconsulting.pl
- Address
- ul. Żelazna 51/53, 00-841 Warszawa, Poland
