Talk to a specialist
Part of Protect

Strategic cybersecurity consulting

We turn security into a program with direction: we measure your maturity, define where to go, order the investments and stay with you while they are carried out.

Talk to a consultantFrequently asked questions

What is included

  • Maturity assessment against a framework such as NIST CSF 2.0
  • Phased roadmap with priorities, dependencies and owners
  • Security governance: roles, committees and metrics for leadership
  • Security architecture and secure network design, with zones and segmentation
  • Third-party and vendor risk management
  • Support for the security leadership during execution

This is for you if

  • You have tools, but no program that orders them
  • You must explain to the board where to invest and why
  • Your security lead is changing and you need continuity

How we do it

  1. Current maturity

    We measure which security capabilities exist today and how well they operate.

  2. Vision and gaps

    We define the level your business needs and the distance to get there.

  3. Prioritized roadmap

    We order initiatives by risk, effort and dependencies, in phases you can fund.

  4. Support

    We follow the phases with your team and measure progress against the plan.

What you receive

  • Maturity report
  • Phased roadmap
  • Governance model and metrics
  • Business cases for the investments
  • Follow-up meetings

Frameworks and methodologies

  • NIST CSF 2.0
  • ISO/IEC 27001
  • CIS Controls
  • COBIT 2019

Related experience

We group experiences without identifying clients or publishing sensitive data. Results correspond to the documented scope of each engagement.

See all experiences
  • Consolidated experience 06

    Multi-sectorAudit

    Controls audit and security governance

    Problem
    Organizations needed to review controls, responsibilities and operating conditions to inform their security decisions.
    Results
    • Security policies and responsibilities documented.
    • Controls and observed conditions recorded.
    • Recommendations for reviewing and improving controls.

    Identities withheld

  • Consolidated experience 07

    Multi-sectorProtection

    Email, cloud identity and configuration hardening

    Problem
    Email, account, permission and connectivity configurations needed review and adjustment to reduce exposure and improve their controls.
    Results
    • Email, identity and permission changes documented.
    • Fixes and controls with a recorded close-out.
    • Partial measures and dependencies identified.

    Identities withheld

  • Consolidated experience 08

    Multi-sectorProtection

    Data protection, detection and security monitoring

    Problem
    Different organizations needed to centralize information controls and improve visibility of security-relevant events.
    Results
    • Devices and policies centralized, depending on scope.
    • Event and alert integration documented.
    • Monitoring rules and tests recorded.

    Identities withheld

Consolidated experience 06

AuditMulti-sector

Controls audit and security governance

Sectors served

  • Government
  • Aviation
  • Banking
  • Private sector

Services offered / delivered

  • Diagnosis of security governance and controls
  • Drafting of policies and guidelines
  • Inspection of physical and environmental controls

Context

This experience consolidates controls reviews, document drafting and physical inspections. These were separate engagements that fed into security governance.

Documented interventions

  • Review of controls and responsibilities through interviews, documentation and checklists.
  • Drafting of access, secure development, network, password and acceptable use policies in the engagements that included that service.
  • Inspection of physical, environmental and operational conditions at the facilities assessed.

Documented results

  • Guidelines and documents on responsibilities and operation were delivered in the document-based consulting projects.
  • The assessments and inspections recorded responses and observed conditions, with recommendations bound by the scope of each report.

Scope of the result

We do not claim ISO certification, full compliance or operational adoption of every policy. An inspection describes conditions observed, not permanent compliance.

Methodology

Document review, interviews, checklists and on-site inspection, depending on the engagement.

Identities withheld

Consolidated experience 07

ProtectionMulti-sector

Email, cloud identity and configuration hardening

Sectors served

  • Legal
  • Private sector

Services offered / delivered

  • Microsoft 365 audit and remediation
  • Email protection and identity controls
  • Firewall and service reconfiguration, depending on scope

Context

This group covers engagements to review and adjust email, identity and connectivity-security configurations.

Documented interventions

  • Review of accounts, privileges, authorized applications and email protection settings.
  • Application of documented changes to authentication, permissions and publishing controls.
  • Record of close-outs, partial mitigations and dependencies on infrastructure or licensing.

Documented results

  • There are reports with changes applied and close-outs recorded, alongside items that were mitigated or remain pending.
  • The documentation distinguishes email and identity controls from residual infrastructure tasks and from data policies that remain in monitoring.

Scope of the result

Remediation is not presented as complete where dependencies or partial items remain. A DLP rule in monitoring mode is not described as preventive blocking.

Methodology

Configuration audit, documented changes and validation of controls based on the evidence available.

Identities withheld

Consolidated experience 08

ProtectionMulti-sector

Data protection, detection and security monitoring

Sectors served

  • Banking
  • Private sector

Services offered / delivered

  • Centralized management and DLP implementation
  • Policy configuration and information classification
  • Honeypots and event integration with a SIEM

Context

Two lines of experience come together here: data protection and event detection. They are not stages of a single project or a universal deployment.

Documented interventions

  • Data protection: centralization of devices and creation of documented rules, including policies in monitoring mode and test rules.
  • Detection: honeypot configuration, event ingestion and integration of rules and alerts in specific engagements.
  • Additional integrations: phases that have only planning, instructions or progress without a close-out are kept as partial.

Documented results

  • The reports support configured controls and tests or monitoring, within their respective scopes.
  • In detection engagements, active decoys, event ingestion and enabled rules were documented.

Scope of the result

We do not claim general DLP blocking, a complete CASB deployment, prevention of all leaks or a 24/7 SOC. A description of use cases does not prove that real attacks were detected.

Methodology

Control configuration, documented testing and review of event ingestion and integration.

Identities withheld

Frequently asked questions

What is a maturity assessment?

A measurement of how developed your security capabilities are (identify, protect, detect, respond and recover) against a framework such as NIST CSF. It helps you decide where to invest first.

Do you replace my security team?

No, we complement it. We bring senior judgment, method and targeted execution, and we leave the program documented so your team can run it.

How often should the assessment be repeated?

When your environment, your business or your obligations change, and at least at the end of each roadmap phase, to verify progress.

Related services

Let's talk about your security strategy

Tell us the challenge you are working on. A SoluProTec consultant reviews your request and contacts you through the channel you provide.

Talk to a consultant