Cybersecurity and AI governance for organisations that answer to a regulator
IRM-Advisors helps financial institutions, crypto firms and critical infrastructure operators in Switzerland and Europe lead security, assess maturity, select the right SOC and govern AI. Every engagement is delivered personally by Daniel Anastasi, with 26 years of experience in cybersecurity.
- FINMA Guidance 08/2024 on governance and risk management when using AI
- DORA applies to EU financial entities and their ICT providers
- Swiss critical infrastructure must report cyberattacks to the NCSC within 24 hours
Nine services in three areas
Lead
Security leadership and board oversight
Assess
Independent assessments with a prioritised roadmap
Cybersecurity maturity assessment
An independent maturity score across CIS Controls, ISO 27001, NIST CSF and COBIT, with a roadmap your board can fund.
SOC maturity assessment
An independent review of your in-house or managed SOC: detection coverage, processes, people and contract performance.
OT / ICS cybersecurity
IEC 62443-based assessments and governance for energy, water and industrial operators, including Swiss incident-reporting readiness.
Build and buy
Implement standards, select providers, prepare for incidents
ISO 27001 implementation
Readiness assessment, ISMS design and audit support, sized to your organisation and led by a certified lead implementer and lead auditor.
AI governance (ISO 42001)
AI inventory, risk classification and an ISO/IEC 42001 management system, aligned with FINMA Guidance 08/2024 and the EU AI Act.
SOC RFP support
Requirements, RFP, scoring and contract terms for selecting a managed SOC or MDR provider, without vendor bias.
Incident response management
Plans, reporting playbooks and exercises before an incident, and senior crisis management during one.
Built for regulated organisations
From 10 to 900 staff, with real regulatory exposure and no large in-house security team.
- Banks, asset managers and external asset managers supervised by FINMA
- Crypto and digital-asset firms working towards licensing or enterprise clients
- Insurers and fintechs serving EU clients under DORA
- Energy, water and industrial operators running OT and control systems
- Healthcare and international organisations with demanding security requirements
Selected engagements
- Large Swiss bankDefined and improved the bank’s cybersecurity controls.CISO on demand →
- Asset managersCISO as a service for FINMA-supervised asset managers.CISO on demand →
- Large outsourcing accountsInformation Security and Compliance Officer across 400 sites worldwide.CISO on demand →
- Global healthcare organisationCybersecurity maturity assessment based on the NIST Cybersecurity Framework.Cybersecurity maturity assessment →
- Swiss electricity grid operatorCybersecurity assessment against Swiss laws and regulations.OT / ICS cybersecurity →
- Asset managerMaturity assessment of an outsourced SOC.SOC maturity assessment →
- Large international organisationInsider-threat assessment.Cybersecurity maturity assessment →
- Several organisationsISO/IEC 27001 readiness and implementation, each leading to successful certification.ISO 27001 implementation →
Client names are confidential.
Three engagement models, agreed in advance
Fixed-scope assessment
Maturity, SOC, ISO/IEC 42001 or OT assessment with a defined report and roadmap.
Fixed price, quoted after a scoping callMonthly retainer
CISO on demand, governance support or incident management, a fixed number of days each month.
Fixed monthly feeProject
SOC selection, ISO/IEC 27001 or 42001 implementation, board programme. Fixed milestones.
Quoted per projectCertified across security, risk, audit, AI and board governance
Daniel Anastasi has advised regulated organisations for 26 years, including as Global Information Security Officer for an outsourcing account spanning 400 sites and as head of consulting in the Middle East for Orange Cyberdefense. He holds the IMD Board Director Diploma.
Fully independent: no product or SOC resale, no vendor referral fees.
About Daniel Anastasi →
Discuss your situation in a 30-minute call. No preparation needed.
Book a call