CYBERSECURITY · RISK · ASSURANCE01 / LEADERSHIP↗
Virtual CISO & Security Governance
Senior security leadership, governance design, strategy, risk oversight and executive reporting.
Security roadmapsBoard-level oversight
Discuss security leadership ↗ SENIOR-LED SECURITY & REGULATORY ADVISORY
Security governance.
Risk management. Business resilience.
GOVERNANCE · AUDIT · COMPLIANCECSP SEC supports organisations with governance, management-system implementation, independent assessments and tailored training. We turn applicable requirements into accountable decisions, operating controls and evidence.
Internal audit · ISO management systems · Data protection · Risk management · Business continuity
VISUAL MODEL · DEMONSTRATION DATA
Senior perspectiveExperienced leadership on complex assignments
Practical deliveryWorkable controls, ownership and evidence
Independent assessmentObjective reviews with impartiality safeguards
International reachRemote advisory with European regulatory expertise
STRATEGIC ADVISORYLeadership grounded in business priorities.Explore our services ↗
EVIDENCE & ASSURANCEFindings converted into owned actions.Explore dashboard examples ↗
RISK & RESILIENCEPrepare for disruption. Protect what matters.Explore risk & continuity ↗
Illustrative imagery and sample materials. No client information is displayed.
START WITH THE BUSINESS CHALLENGE
What needs to change
in your organisation?
Security and compliance work should start with a decision, risk or obligation, not a stack of documents. Choose the situation that best reflects your needs.
01 / BUILD
We need to build or improve our security framework.
Establish governance, implement controls and prepare for certification or an external review.
Explore implementation ↗ 02 / DEMONSTRATEWe need to demonstrate compliance or control effectiveness.
Clarify obligations, identify gaps and establish reliable evidence for auditors or stakeholders.
Explore assessments ↗ 03 / LEADWe need experienced security leadership.
Access fractional CISO, risk oversight and strategic guidance without building a full-time function.
Explore advisory ↗WHAT WE DO
Advisory, implementation and assurance.
Specialist services that bridge executive decisions, operational requirements and credible assurance. Tailored to your scope, risk and stage of maturity.
02 / ASSURANCE◎
Internal Audit & Independent Assessment
Risk-based audits and evidence reviews to evaluate conformity, control effectiveness and gaps.
Internal audit reportsCorrective action follow-up
Explore audit services ↗03 / IMPLEMENTATION▤
ISO Management Systems & Implementation
Design, implementation and improvement of information security, business continuity and quality management systems, including integrated systems and certification readiness.
ISO/IEC 27001 · ISO 22301 · ISO 9001Integrated systems & audit readiness
Explore implementation ↗04 / REGULATION§
Regulatory Compliance & Privacy
GDPR, DORA, NIS2 and applicable Central Bank of Kosovo requirements, including practical gap assessments and implementation support.
Obligations mappingRemediation roadmaps
Explore compliance work ↗05 / RISK MANAGEMENT⌁
Enterprise Risk Management
Identify, evaluate and treat strategic, operational and information security risks using an organisation-wide approach.
ISO 31000-aligned methodsRisk registers & treatment
Explore risk management ↗06 / CONTINUITY↻
Business Continuity & Operational Resilience
Protect critical operations through business impact analysis, recovery strategies, continuity planning, crisis management and practical exercises.
Recovery & crisis planningOperational exercises
Explore continuity services ↗07 / CLOUD◇
Cloud Security & Data Protection
Cloud and SaaS governance, supplier assurance, cloud privacy controls and SOC 2 readiness advisory.
Cloud risk oversightSecurity & privacy alignment
Explore cloud assurance ↗✳
Framework expertise without one-size-fits-all answers. Our work draws on relevant ISO standards, European regulation and recognised risk and assurance practices. We select what fits the organisation rather than forcing every client into the same checklist.
Explore our framework areas ↗RISK MANAGEMENT & BUSINESS CONTINUITY
Anticipate uncertainty.
Prepare for disruption.
Enterprise risk management supports informed decisions about uncertainty. Business continuity focuses on protecting and recovering critical operations when disruption occurs, beyond management system documentation.
RISK ASSESSMENT / DEMO01 / RISK MANAGEMENT
Identify exposures. Make informed decisions.
Establish risk criteria, maintain meaningful risk registers, select treatments and support management risk oversight.
Discuss risk management
CONTINUITY PLANNING / DEMO02 / BUSINESS CONTINUITY
Keep critical operations running.
Define recovery priorities through business impact analysis, develop continuity responses, exercise plans and review resilience evidence.
Discuss continuity & resilienceWHAT CLIENTS RECEIVE
Defined outputs.
Evidence that supports decisions.
Our deliverables connect requirements to responsible owners, operational decisions and evidence. The exact outputs depend on engagement scope and independence requirements.
ILLUSTRATIVE DELIVERABLE STRUCTURE● ● ●
ASSESSMENT → ACTION
From a finding
to verified closure.
A clear trail from the requirement and observed gap to risk, accountable owner, evidence and review.
01RequirementWhat applies?
02Gap & riskWhat is missing?
03Action ownerWho fixes it?
04Evidence reviewDoes it work?
EXAMPLE WORKFLOW · NOT A CLIENT REPORT
01
Regulatory obligation maps
Clear applicability decisions and actionable requirements, including relevant dependencies.
02
Risk registers and treatment plans
Risk ownership, rationale, priorities and documented treatment decisions.
03
Control and evidence matrices
Traceable control objectives, operating evidence and assigned responsibilities.
04
Audit reports and corrective actions
Documented findings, practical remediation and follow-up verification.
05
Management-ready decision reports
Concise reporting on risk exposure, compliance gaps and required decisions.
WHAT DECISION-MAKERS NEED TO SEE
Decision-ready views of
risk, findings and delivery.
See the types of evidence-led dashboards we can develop to help teams prioritise action, report progress and focus management attention.
Different assignments. Consistent discipline. Traceable findings, clear owners and decision-ready reporting.Talk about reporting needs
CSP SEC / COMPLIANCE ASSESSMENT HUB
Assess readiness before you commit.
Use a free, browser-based readiness check to surface potential gaps. Then, where needed, move to a professional evidence-based assessment.
PRIVACY & ACCOUNTABILITYG
GDPR readiness
Explore key practices for lawful processing, governance, individual rights and security.
12 questionsPrivate browser-only check
Begin GDPR check DIGITAL OPERATIONAL RESILIENCED
DORA readiness
Assess selected financial-entity obligations or ICT supplier-assurance themes.
Role-dependentScope-sensitive
Begin DORA check CYBERSECURITY GOVERNANCEN
NIS2 readiness
Review selected cybersecurity measures, subject to national-law applicability.
10 questionsNational-law scope
Begin NIS2 check KOSOVO / FINANCIAL SECTOR
CBK ICT & Security Risk Readiness
Preparing for Central Bank of Kosovo supervisory requirements? We support financial institutions with regulatory scope analysis, ICT risk governance, business continuity, evidence reviews and practical remediation planning.
Explore CBK assessment services
ILLUSTRATIVE REPORTING EXAMPLEPreliminary result, not a compliance rating. Self-reported weighted readiness cannot establish GDPR, DORA or NIS2 compliance, audit findings or certification. Applicability and evidence need professional review.
NEXT STEP
Discuss a professional assessment ↗Need a defensible conclusion?
Commission a scoped GDPR audit, DORA or NIS2 gap review, or CBK ICT and security risk assessment with evidence-based findings.
ILLUSTRATIVE TRAINING VISUALCSP SEC / LEARNING & DEVELOPMENT
Training that builds
operational capability.
From PECB certification training to role-based in-house workshops, we help professionals and management teams build the understanding needed to put security, risk and regulatory requirements into practice.
01PECB certification trainingProfessional training through our PECB partnership
02Tailored corporate programmesYour sector, risks, controls and people
03Executive & board workshopsAccountability, resilience and decision-making
STANDARDS & REGULATORY EXPERTISE
Our capabilities evolve.
Our approach stays rigorous.
Rather than promote a fixed list of individual certificates on every page, we organise expertise around the business needs it supports. Below are representative areas, not an exhaustive catalogue or a claim of accredited certification.
Ask about a specific requirement ↗Information security, cloud & privacy +
ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018; security and privacy governance for cloud and SaaS environments.
ISO management systems & implementation +
ISO/IEC 27001 (information security), ISO 22301 (business continuity) and ISO 9001 (quality); implementation and improvement of individual or integrated management systems.
Enterprise risk & operational resilience +
ISO 31000-aligned risk management, business impact analysis, recovery strategies, resilience exercises and crisis management. ISO 31000 provides guidance, not management system certification.
Regulatory compliance & assurance +
GDPR, DORA, NIS2 and relevant Central Bank of Kosovo regulations; applicability analysis, control mapping and evidence-based assessment. SOC 2 readiness support is also available.
OUR WORKING METHOD
A disciplined route
from scope to evidence.
Our methodology is proportionate to each engagement. Implementation and independent audit services are scoped separately where necessary to preserve objectivity.
01 / UNDERSTAND
Scope what matters
Business objectives, obligations, governance and risk context.
02 / EVALUATE
Find the real gaps
Processes, controls, dependencies and supporting evidence.
03 / ACT
Build what works
Proportionate measures, ownership, priorities and implementation.
04 / VERIFY
Prove effectiveness
Assess results, document findings and support improvement.
Independence by design.When CSP SEC has participated in implementation, independent audit eligibility is assessed separately to avoid self-review and conflicts of interest.
CSP SEC / INSIGHTS & ANALYSIS
Source-grounded analysis.
Operational perspective.
Regulatory developments, implementation lessons and audit perspectives explained for decision-makers, not just specialists.
WHY CSP SEC
Specialist attention.
Senior-level judgment.
Experienced governance, risk, compliance and assurance support for organisations facing complex requirements.
Clients need more than a template or a high-level statement of conformity. They need experienced judgment about which requirements apply, which risks matter and what credible implementation looks like.
CSP SEC is led by a professional with more than 15 years of experience spanning security governance, regulatory supervision, organisational leadership and audit. We bring that perspective directly into our engagements.
15+ yearsRelevant professional experience of our practice lead
Cross-disciplinarySecurity, risk, privacy, continuity and governance
View selected individual professional qualifications ↘
PECB Chief Information Security Officer; ISO/IEC 27001 Lead Auditor; ISO 22301 Lead Auditor; ISO 9001 Lead Auditor; PECB Lead Cloud Security Manager; PECB ISO 31000 Lead Risk Manager. Qualifications belong to the individual professional, not to CSP SEC as an accredited certification body.
ENGAGEMENT OPTIONS
Flexible engagements. Defined outputs.
From targeted assessments to long-term advisory relationships, we agree scope, responsibilities, outputs and decision points before work begins.
Focused project
A defined scope: gap analysis, implementation project, risk review or regulatory workstream.
Ongoing advisory
Fractional CISO and continuing governance, risk and compliance support.
Independent assessment
Appropriately scoped audits or objective reviews, with written findings and recommendations.
LET'S START WITH YOUR CHALLENGE
Discuss your priorities.
We’ll help define the next step.
Whether you need a compliance assessment, stronger governance or senior security advisory support, tell us what you are working toward.
SEND A BUSINESS ENQUIRY
Prefer email? mentor.hoxhaj@csp-sec.com