Cybersecurity & continuity · Consulting

Know your real exposure before attackers do

Cybersecurity consulting for companies and boards: we identify risks, prioritize controls and support their implementation using recognized frameworks and language leadership understands.

Request an assessmentView services
Direct answer

Why consulting if we already have a firewall and antivirus?

Because tools only protect what is properly configured and monitored. Without testing, policies and clear owners, protection can be little more than a feeling.

Consulting reviews how controls actually work, which risks remain open and what to address first based on business impact.

Warning signs

When an assessment makes sense

Never assessed

There is no independent review of controls and no up-to-date risk inventory.

Evidence is requested

A client, bank, auditor or regulator asks for proof that information is protected.

Operations changed

Remote work, cloud use or the number of vendors with system access has grown.

There was an incident

You suffered fraud, ransomware or an intrusion attempt and need to prevent it from happening again.

Services

What the consulting covers

Services you can combine according to your maturity, obligations and priorities.

Risk and maturity assessment

Assessment against NIST CSF 2.0 and ISO/IEC 27001, with gaps, maturity level and priorities.

Security governance and policies

Policies, roles, a security committee and indicators so leadership can decide with facts.

CISO as a Service

ISO/IEC 27001 readiness

Gap analysis, ISMS preparation and support on the road to certification.

ISO/IEC 27001

IT audit and controls review

Independent review of IT general controls, access, change management, backups and technology risk.

View IT audit

Technical testing management

We scope vulnerability assessments and penetration tests, interpret the findings and track remediation.

Incident response and continuity

Incident response, continuity and recovery plans, with tabletop exercises.

View continuity
Methodology

NIST Cybersecurity Framework 2.0 as the backbone

We organize the assessment and the plan around the framework's six functions, complemented by ISO/IEC 27001, COBIT and MITRE ATT&CK.

Govern (GV)
Strategy, roles, policies, supply chain risk and board oversight.
ID

Identify

Critical assets, data and risks.

PR

Protect

Access, configuration, data and awareness.

DE

Detect

Monitoring and early warning.

RS

Respond

Containment, communication and analysis.

RC

Recover

Restoration and lessons learned.

ISO/IEC 27001:2022

Information security management system and Annex A controls.

COBIT 2019

IT governance aligned with business objectives.

NIST SP 800-30

Risk analysis by likelihood and impact.

MITRE ATT&CK

Maps risks to real attacker tactics.

Process

Five stages, from scope to measurement

Each stage ends with a verifiable deliverable and a leadership decision.

01

Scope and context

Objectives, critical assets, and regulatory and contractual requirements.

02

Assessment

Interviews, evidence review and key configuration checks.

03

Risk analysis

Likelihood and business impact of each gap.

04

Remediation plan

Actions ranked by risk, with owners, costs and timelines.

05

Follow-through

Tracking, board indicators and reassessment.

Engagement models

Choose how deep the support goes

One-time assessment

An assessment with defined deliverables and a prioritized remediation plan.

Implementation project

Support to close prioritized gaps: policies, ISO/IEC 27001 or continuity.

Experience

Who leads the engagement

LandoHOUSE leadership brings more than 30 years of experience since 1991 in technology, IT audit, internal control, risk and continuity, at audit firms and in the financial sector.

See the track record and verifiable credentials.

Clear scope

Responsibilities defined in writing

Included per scope

  • Assessment and risk analysis
  • Executive and technical report
  • Prioritized remediation plan
  • Results presentation to leadership

Not included or contracted separately

  • Purchase of licenses or equipment
  • Technical testing without written client authorization
  • Hands-on technical changes, unless agreed
  • A guarantee that no incidents will occur
FAQ

Direct answers

How is this different from CISO as a Service?

Consulting has a defined scope and end date: it assesses, prioritizes and delivers a plan. CISO as a Service is an ongoing function that leads the execution of that plan month after month.

What is the NIST Cybersecurity Framework 2.0?

It is a framework from the US National Institute of Standards and Technology that organizes cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It helps measure maturity and set priorities.

Do I need a penetration test?

It depends on your exposure and obligations. During the assessment we define whether it makes sense, with what scope and on which systems, and help you interpret the results.

Will the assessment disrupt operations?

It should not. It is planned with your team, schedules are agreed, and any technical test requires prior written authorization.

How do you protect the information we share?

We work under confidentiality agreements, request only the information we need, and never ask for passwords by email or forms.

Contact

Ready to learn your real level of exposure?

Which process, risk or opportunity does your company need to address? Let's talk to understand your situation and define the next step.

CoverageBased in Guatemala · regional service according to the agreed scope

Let's talk about your next project

Tell us what you need to improve, build or protect. We will review your request and coordinate the next step.