Summary: The need for information security expertise looks different in different organisations. Sometimes a senior consultant is needed for a defined piece of work. In other cases, someone needs to step in and lead the security work as an interim CISO for a period. Kristensson i Skåne offers both – with the option of local presence in Malmö, Lund, Helsingborg and the rest of Skåne.
Information security has become an increasingly clear management and business issue.
New regulatory requirements, increased digitalisation, external suppliers, cloud services and a changing threat landscape mean that many organisations need more security expertise than before.
But that does not automatically mean the organisation needs to build a large internal security function or hire a full-time CISO.
Sometimes what is needed instead is the right senior expertise at the right time.
It can be an information security consultant who helps with risk work, ISO 27001, the Cybersecurity Act/NIS2 or a current-state analysis.
It can also be an interim CISO who, for a period, takes clearer responsibility for leading, prioritising and holding the security work together.
When does an information security consultant fit?
An information security consultant is often right when the organisation has a defined need but needs senior expertise to move forward.
It can, for example, involve:
- carrying out a current-state or gap analysis
- establishing or developing an information security management system
- working with ISO 27001
- handling requirements from the Cybersecurity Act/NIS2, DORA or other regulations
- carrying out risk analyses
- developing incident and continuity handling
- reviewing suppliers and third-party risks
- creating or improving governance documents and processes
- verifying that security measures actually work
- supporting management or an internal security function
Our starting point is that the consulting support should lead on to practical work. An analysis or report is often a good start, but it needs to be followed by priorities, responsibilities and feasible measures.
When is an interim CISO needed?
In other situations, advice on individual questions is not enough. The organisation may need someone who actually holds the security work together.
An interim CISO can, for example, be relevant when:
- a CISO or security lead has left
- the organisation is not yet ready to recruit a permanent CISO
- a larger security or compliance programme needs to be led
- several parallel security initiatives need to be prioritised and coordinated
- management needs clearer reporting and decision support
- the organisation is undergoing rapid change
- the existing IT or security function needs temporary senior reinforcement
In such an engagement, the work is not only about giving advice. An interim CISO needs to be able to work together with management, IT, the business, risk, legal, data protection, procurement and external suppliers.
The role can cover everything from security strategy and risk management to prioritising measures, management reporting, incident readiness and follow-up.
Kristensson i Skåne offers interim CISO as part of our Manager as a Service offering, where senior people can step into leading roles for a limited or longer period.
Sometimes something in between is needed
The need is not always black or white. Many organisations do not need a full-time CISO but need more than ad hoc efforts from a consultant.
Then an ongoing arrangement can be more effective. A senior information security consultant can, for example, work recurringly with:
- risk follow-up
- a security roadmap
- management reporting
- supplier reviews
- audits and controls
- regulatory questions
- incident readiness
- follow-up of security measures
If the need changes, the support can be scaled up or move into a more operational interim CISO engagement. We go deeper into the choice between the roles in our insight Interim CISO or ongoing GRC advisory?
For us, the first question is therefore rarely “Do you need a CISO?”. A better question is “What responsibility and what security capability does the organisation lack today?”. From the answer, it is possible to find the right form and scope.
Senior expertise from analysis to implementation
Information security moves between several levels.
Management needs to understand risks and make decisions. The business needs to know which requirements and ways of working apply. IT needs to be able to translate the security requirements into technical controls. Risk, compliance and data protection functions need to be able to follow up compliance.
That is why an information security consultant needs to be able to move between strategy, governance and practical implementation. It is an important part of our way of working.
We work with, among other things:
- information security governance
- ISO 27001 and the ISMS
- the Cybersecurity Act/NIS2
- risk management
- GRC
- incident handling
- continuity and operational resilience
- supplier and third-party risk
- data protection and GDPR
- cybersecurity and technical security
- assurance and internal control
- CISO and management support
This means the same partner can help identify a problem, prioritise what needs to be done and then support the organisation in the implementation.
Smaller and independent – with senior presence
We are a smaller, independent consultancy. For our clients that mainly means short decision paths and direct access to senior expertise. The person you discuss the engagement with is also close to the actual delivery.
For information security work, we think that is particularly important. The consultant needs to understand the business, the risk picture, the technology and the decisions that have already been made. That knowledge is built up over time.
At the same time, we try to create continuity by having more than one person familiar with the engagement when needed. The goal is not to build the largest possible consulting team. The goal is to give the client the right expertise and sufficient capacity for the actual need.
Information security consultant in Malmö and Lund
For organisations in Malmö and Lund, we can combine ongoing remote work with physical presence when it adds value. That can, for example, be during:
- workshops
- management meetings
- risk analyses
- current-state assessments
- incident exercises
- steering group meetings
- interviews and business reviews
Malmö and Lund have many organisations where technology, research, life science, SaaS, industry, the public sector and other regulated environments meet. In such organisations, information security work often needs to handle both technical questions, business risk and regulatory requirements.
Our role can be anything from specialist support on a single question to a more long-term advisory or leading engagement.
Information security consultant and CISO support in Helsingborg
We also work with organisations in Helsingborg and north-western Skåne. Just as in the rest of the region, the support can be delivered as a combination of local presence and ongoing remote work.
For organisations that lack their own senior information security function, it can be an effective way to access the expertise without immediately having to build a full internal organisation.
The need can start with a gap analysis or a specific security project and then develop into ongoing GRC or CISO support.
Local presence when it creates value
Much information security work can today be carried out very well remotely. But some parts become better when the consultant is actually on site.
This is especially true when people from different parts of the organisation need to gather, when business processes need to be understood or when a complex problem needs to be discussed together with management and key people.
That is why we see local presence as a complement to effective digital delivery – not as an end in itself. Based in Skåne, we can work closely with organisations in Malmö, Lund, Helsingborg and the rest of the region, while also carrying out engagements in other parts of Sweden.
From a single consulting effort to long-term security capability
There is no standard answer to how much external information security expertise an organisation needs.
For some, a defined project is enough. Others need a few days of senior advisory each month. In some situations, an interim CISO working closely with the organisation several days a week is needed.
What matters is choosing an arrangement that matches the actual need. We therefore prefer to start by understanding:
- what the organisation wants to achieve
- which risks and requirements are most important
- what expertise already exists internally
- what responsibility is missing
- how much practical implementation is needed
- how the support should change over time
From there, it is possible to design support that is proportionate. It can start with an information security consultant. It can develop into ongoing CISO support. And during certain periods, an interim CISO may be what is needed to create structure and momentum.
Do you need an information security consultant or interim CISO in Skåne?
Kristensson i Skåne offers senior information security expertise to organisations in Malmö, Lund, Helsingborg and the rest of Skåne, with engagements nationally too.
We can help on a defined question, reinforce your existing function or step into an operational leadership role for a period.
The starting point is the same: the right expertise, the right scope and security work that functions in the business – not just on paper.
Would you like to discuss which arrangement suits your organisation? Contact us and we will have a first conversation about your current state and needs.
Frequently asked questions
Does Kristensson i Skåne offer an information security consultant in Malmö, Lund and Helsingborg?
Yes. We are based in Skåne and work with clients in Malmö, Lund, Helsingborg and the rest of the region, with engagements nationally too. We combine ongoing remote work with physical presence when it adds value, for example during workshops, risk analyses, management meetings and incident exercises.
What is the difference between an information security consultant and an interim CISO?
An information security consultant often supports a defined need, for example a gap analysis, ISO 27001, a risk analysis or regulatory requirements. An interim CISO instead steps in and leads the security work for a period – responsible for prioritising, coordinating and reporting to management. The support can scale between the two depending on the situation.
When does an interim CISO fit?
An interim CISO often fits when a security lead has left, when a permanent recruitment is not complete, when a larger security or compliance programme needs to be led, or when several parallel initiatives need to be prioritised and coordinated. Kristensson i Skåne offers interim CISO as part of the Manager as a Service offering.
Do we have to hire a full-time CISO?
No. Many organisations do not need a full-time CISO but need more than ad hoc efforts. An ongoing arrangement with senior advisory, or a temporary interim CISO engagement, can provide the right expertise and capacity without building a full internal function.
This is a general description of our services and not legal advice in an individual case.