Preparing for ISO 27001
A customer requires certification and you need to understand the scope of work, priorities and a realistic preparation plan.
An independent partner for your business
Security
you can
rely on.
I help you manage information and cyber security. From an initial risk assessment to implementing controls and reporting to management.
INFORMATION & CYBER SECURITY
Tomáš RakuščinecVirtual CISO and security advisor
Who I work with
For businesses that need
to take ownership of security.
Growing and mid-sized businesses, suppliers facing customer security requirements, and organisations in regulated sectors. Especially where management and the internal IT team need an experienced partner without a full-time CISO position.
Common situations
What do you need to resolve?
NIS2 / Czech Cyber Security Act
You need to identify your obligations and prepare for communication with NÚKIB (the Czech National Cyber and Information Security Agency).
An automotive customer’s requirements
A business partner requires TISAX and you need to assess readiness and plan the next steps.
Security needs an owner
IT handles daily operations, but someone needs to set security priorities and track progress.
How I can help
Focused work.
Clearly defined deliverables.
01 / LEADERSHIP
Virtual CISO
Ongoing security leadership, clear responsibilities and coordination between business management and the technical team.
Deliverables
A security roadmap, a responsibility overview and regular reporting for management.
02 / DECISIONS
Risk & strategy
An assessment of your current position and a selection of actions that fit your risks, available resources and budget.
Deliverables
A gap analysis, risk register and action plan with priorities, owners and agreed deadlines.
03 / RESILIENCE
Incident readiness
Preparing people and procedures for situations that require fast decisions, a coordinated response and service recovery.
Deliverables
An incident response plan, contact and escalation procedures, and a scenario for a team exercise.
Areas of expertise
Turning requirements
into everyday practice.
For each framework, I start by assessing your current position. This is followed by a preparation plan, clear responsibilities and support with implementing the necessary controls.
01 / SECURITY MANAGEMENT
ISO 27001
The international standard for an information security management system. You receive a gap analysis and a prioritised plan for implementing controls and preparing for a certification audit.
02 / CYBER SECURITY
NIS2 / Czech Cyber Security Act
Czech cyber security requirements, including the lower- and higher-obligation regimes. You receive an assessment of the requirements relevant to your organisation and an action plan with owners and priorities.
03 / DIGITAL RESILIENCE
DORA
The EU framework for digital operational resilience in the financial sector. You receive a review of ICT risks and supplier oversight, with actions to improve readiness for outages and incidents.
04 / PRODUCT SECURITY
CRA
EU cyber security requirements for products with digital elements. You receive a plan for integrating security and vulnerability management into product development, delivery and support.
05 / AUTOMOTIVE
TISAX
An information security assessment and exchange mechanism for the automotive supply chain. You receive a readiness review, a list of gaps and an evidence preparation plan for the assessment.
How we work together
Understand the situation.
Then agree on the scope.
The first conversation clarifies what you need. We agree on the scope, your team’s involvement and the schedule before starting the engagement.
- 01
Understand your situation
We discuss your goals, current security practices, customer requirements and any deadlines that need to be considered.
- 02
Define priorities and deliverables
We agree on the assessment scope, required information, responsibilities and the format of the resulting plan.
- 03
Put the changes into practice
I support your team with implementation and prepare a progress overview for management.
Ways to work together
Initial assessment
A standalone review with a scope and deliverables agreed in advance.
A defined project
Audit or assessment preparation, a risk analysis, or setting up selected processes.
Ongoing vCISO support
Regular support with an agreed monthly allocation of time based on your organisation’s needs.
Your security partner
Tomáš Rakuščinec
I understand technology — and what it takes to keep it running securely.
My background combines information security, IT operations and team leadership. Technical and management experience allows me to assess both the design of a security control and its impact on how an organisation operates.
I focus on risk management, security assessments and communication between IT and the business. My recommendations reflect actual needs, available resources and what your team can maintain in daily operations.
Selected professional experience
Technical and management experience.
- 2021–present
Independent advisory
vCISO · Information & Cyber Security
Assessing security risks, reviewing security solutions and proposing controls. Working with technical teams, IT management and business stakeholders to define priorities and put them into practice.
- 2021
KPMG Czech Republic
Management Consulting · Cyber Security
Security projects, ISO 27001 compliance assessments, business continuity and disaster recovery plans, and security due diligence for mergers and acquisitions.
- 2019–2021
Axians redtoo
Head of Information Technology
Established an IT services department, led the team and held responsibility for infrastructure security and availability. Led ISO 20000-1 implementation and certification.
- 2016–2019
MallGroup
Head of IT Operations
Led IT operations, capacity planning and infrastructure development. Connected operational needs with business requirements and managed IT resources.
- 2013–2016
Novartis
IT Security Assessment Manager
Coordinated security assessments and external suppliers in an international environment. Defined processes and supported collaboration between IT and internal customers.
- 2006–2013
Earlier career
UNIX/Linux infrastructure
UNIX/Linux administration, high-availability infrastructure, storage, backup and recovery, and enterprise systems integration.
Education & technical background
MSc (Ing.) in Artificial Intelligence, BSc in Cybernetics – Technical University of Košice.
Before we speak
Practical questions
What happens on the first call?
During an introductory 30-minute call, we discuss your situation, expectations and any deadlines. I then propose the next steps and scope of work. We arrange a time by email or phone.
How much time will management and IT need?
Before work starts, we agree on the interviews, documents and meeting schedule needed from management and IT, with named contacts for both teams; implementation tasks are planned alongside your day-to-day operations.
How long does audit preparation take?
After the gap analysis, you receive a preparation schedule with milestones for implementing controls, collecting evidence and reviewing readiness; certification or the assessment itself is carried out by the relevant independent body.
Will you work with our internal IT team?
Yes. The engagement builds on your team’s knowledge. I help set security priorities, assign responsibilities and translate technical findings into information management can use to make decisions.
Contact
Contact me
Call me or send a message about what you need to resolve. We will discuss your situation and the next steps.