Solutions

Start from where
you actually are.

Nobody wakes up wanting third-party risk management. They wake up because a customer sent a questionnaire, or a contract demands a certificate, or something happened last night. Find your situation.

A customer sent us a 300-question security questionnaire.

Someone in your company is currently in a spreadsheet, guessing. The questions assume you have policies, an owner, an asset inventory, an access review, an incident plan: artefacts, not intentions. You can answer it honestly and lose the deal, or answer it optimistically and sign something you cannot defend later.

We need ISO 27001 to close this deal.

You did not wake up wanting a management system. A customer put certification in the contract, and now a standard written for large organisations has landed on a company that does not have a security team. The question you are asking is not "how do we get certified"; it is "what is the shortest honest path to the signature."

Our US customer will not sign without SOC 2.

The American buyer asked for a report, not a certificate, and the two are not the same thing. SOC 2 is an attestation by a US CPA firm about controls you operated over a period of time, which means the report cannot be produced faster than the period it describes. That single fact reorders your entire plan.

Amendment 13 requires a DPO. We never appointed one.

Israel's Privacy Protection Law now obliges many organisations to appoint a Data Protection Officer and an information security officer: real, named, qualified roles with duties, not a line in a policy. Most Israeli mid-market companies have neither, have not noticed, and are non-compliant on that point alone before anyone even looks at their databases. The law created two jobs; the question is who is doing them at your company today.

We shipped an AI feature and customers are asking who governs it.

The model went into the product because it made the product better. Nobody wrote down what data it was trained on, who reviews its outputs, what happens when it is wrong, or which of your customers' users it decides something about. Now an enterprise buyer wants your AI governance policy, and the EU AI Act has obligations that depend on answers you have never had to give.

Nobody here actually owns security.

There is no CISO. Security ended up with whoever was technical enough to be handed the questionnaire, usually the CTO or VP R&D, who now spends his week on vendor reviews and access spreadsheets instead of the product. He is competent enough to do it badly and busy enough to do it never, and the whole thing is held together by his memory.

We have findings and no plan.

The report came back (from an audit, a pentest, a customer's assessor) and it is sitting in a folder. Nobody disputes the findings; there is simply no owner, no plan and no date. You are now in the worst position available: you have written proof that you knew, and no proof that you acted.

Something is happening right now. Who do we call?

Systems are behaving strangely, a ransom note appeared, an employee clicked something, or a customer told you your data is somewhere it should not be. The first hours decide how bad this gets: what gets contained, what evidence survives, and whether the notification you owe your customers and the regulator is made correctly and on time.

Start from whereyou actually are.