How do you get off to a good start?

← Cybersecurity in plain language

Start with one experienced person who can see the whole picture

At the start, you usually do not know exactly what you need. That is normal. So the first person you need is someone who can see the whole picture.

That person gets the programme moving and puts the decisions that are yours in front of you. Together you decide how to proceed and who else you will need, if anyone. That can perfectly well be the same person who then builds the system with you. Having already thought through the whole picture with you, they can start delivering results sooner.

At this stage, direction matters more than perfection. A programme with a clear goal and a few imperfect steps gets further than a perfect measure aimed at the wrong risk.

The person who looks at the whole picture with you should have enough expertise and experience. Someone who is still learning how such a programme works will do that learning on your time and with your budget. With someone who has done it before, your budget goes into your security, not into a learning curve.

1Your reasonWhy you are starting

2One experienced personSees the whole picture and prepares

3You decideSix decisions

Then: who else you need

Six decisions that are yours to make

That first person prepares them. You make them.

1. Why are you starting? Because you fall under NIS2. Because a customer requires it of you as a supplier. Or because you have seen the damage incidents can do to others, perhaps in your own sector, and want better protection but do not know where to begin. Your answer shapes the rest of the programme.
2. Which part of your business does it cover? If you fall under NIS2, your whole organisation is always in scope. For ISO 27001 you can choose, but there too the whole business is often the best choice, certainly for a smaller SME, because it makes the business as a whole more secure. As long as a back door is left open somewhere, the security of the whole is not guaranteed.
3. Do you want just the system, or the certificate as well? The system always matters most. You need a certificate when a customer asks for one, or when you would otherwise keep filling in customer questionnaires. Those questionnaires take a lot of work, each one asks slightly different questions, and your answers are still only your own assessment. If you have no certificate, a customer may even require an external audit to confirm your answers. Customers who ask for this often want to appoint the auditor themselves. By getting certified yourself, you avoid that kind of detour. A certificate means your security has been confirmed independently, so you no longer have to spend that time over and over again. Whatever you choose, keep the system running afterwards. Setting up a system and then letting it fall into neglect is money thrown away.
4. Who owns it internally? Someone inside your business has to own the system. Even if you bring in an external security officer for a longer period (a vCISO), at least one person in-house must know your security inside out. How much time that owner needs depends on your business.
5. Which risks do you accept? For each important risk, you choose whether to deal with it or accept it. Accepting a risk is not a decision to take lightly: you do so knowing what it will mean for you if that very risk materialises. Your guide can prepare the trade-off, but you have to think it through yourself. They are your risks.
6. How much can you spend, and how much will it take? That depends on the size and complexity of your business, so there is no figure here. Any amount quoted by someone who does not know your business will mislead you.

How to recognise that first person

A certificate proves that someone knows the material. It does not prove that they have ever had to apply it, or that they have mastered it in practice. Plenty of people call themselves cybersecurity experts while they still have a lot to learn. So look at what someone has done, not only at the certificates they hold.

• A proven track record. Ask about comparable programmes this person has led personally.
• The same person does the work. The person you talk to should also be the one who carries out the assignment.
• Audited, by different auditors. Someone who has been audited often, by different auditors, knows what auditors consider important, and so where the weak spots usually are.
• A technical background. It lets this person judge whether a measure really improves your security or only looks good on paper.
• A clearly defined assignment. "We secure your business" is not an assignment. A good proposal states what will be visibly different afterwards.
• Your documents stay with you. Part of the work is yours to do, because it is your system. Also agree that every document for your system is available to you at all times, including while you are working on it together. If they are set up so that someone else can pick them up, your programme will not stall if your guide is unavailable for a while.

Then you will know who else you need

Once the decisions are made, it becomes clear who else you need.

Someone also has to put the organisational side of your security in order. That can be the person who got the programme moving, or someone else. Together with you, they write down the agreements: what is and is not allowed in your business, which rules apply and which measures you take. They also help you set up the ways of working that go with them, for example how new staff get access or what you do when something goes wrong, and help you write them down. And they make sure all those documents are correct and that you can show you actually do what they say. That part matters just as much as the technical measures. If you want someone to take it on for longer, the same person can later become your external security officer, the vCISO from the fourth decision.

You may also need a technical specialist who puts measures in place. That may well be your current IT provider. Judge them on what they have actually been through. Do they know from experience what to do when someone takes over an administrator account, when ransomware encrypts your systems on a Friday evening, or when a new access rule suddenly locks out all your staff?

If you are going for certification, you also need an internal auditor. If you are not, an internal audit is optional, but a good internal auditor adds value either way. They check whether the whole system works and really protects you, so that you know it rather than assume it. Only someone who did not help build the system can do that. From that independent angle, a good auditor will often also suggest low-effort ways to improve your system.

Why that has to be someone else: Whoever builds it does not check it

Start with one sentence

Want to do something today? Write down in one sentence why you are starting. Then ask every candidate you speak to what you will have to show for it after three months. A concrete answer to that question tells you more than a list of certificates.

Previous: The road to ISO 27001 in eight steps