Information security management
We organise security as an ongoing activity, not a one-off project. We set out responsibilities, track risks and measures, and report to management at the agreed frequency.
What you receive
- Security responsibilities and decision points
- Inventory of systems, accounts, sensitive data and permissions
- Checking accounts and permissions, with corrections
- Steps, roles, contacts and reporting obligations
When it helps
- Security depends on a single person or on the IT supplier.
- There is no record of accounts, access and sensitive data.
- The company has no plan for security incidents.
- Management does not receive a regular view of the risks.
Activities and deliverables
Role organisation
Security responsibilities and decision points
Asset and access register
Inventory of systems, accounts, sensitive data and permissions
Periodic access review
Checking accounts and permissions, with corrections
Incident response plan
Steps, roles, contacts and reporting obligations
Supplier security
Requirements and assessment for critical suppliers
Training and reporting
Sessions for the team and a periodic report for management
What we aim for
The objectives of the engagement, not guaranteed results.
- Clear responsibilities for security.
- Risks and measures reviewed regularly.
- An incident response plan the team knows.
- Simple, regular reporting to management.
What the result depends on
Effectiveness depends on management's involvement, access to the relevant systems and suppliers, resources for technical measures and the team following the rules.
Responsibilities and limits
What UDG Group does
- Organise the security programme and its working rhythm.
- Coordinate access reviews and risk assessments.
- Prepare and rehearse the incident response plan.
- Report to management at the agreed frequency.
What stays with your company
- Appoints an internal owner.
- Approves decisions on risks and budget.
- Applies the rules and implements the technical measures.
What is not included
- Continuous security monitoring (SOC).
- Incident response with guaranteed response times, unless explicitly set out in the contract.
- Taking on the legal responsibilities of the company's management.
Steps
Initial assessment
Assets, access, risks and existing practices.
Security programme
Roles, priorities and schedule.
Baseline measures
Access, multi-factor authentication, backup, incident plan.
Ongoing rhythm
Periodic reviews, training and reporting.
What affects timing and cost
Scope, timing and cost are agreed in writing before any work starts.
- The size of the company and the number of systems.
- How often reviews and reporting take place.
- The number of critical suppliers.
- Whether technical measures are included.
Frequently asked questions
How does this differ from compliance?
Compliance establishes which requirements must be met and prepares the documentation. Security management deals with applying and following up the measures over time.
Do you offer continuous monitoring?
No. We organise and coordinate security, but we do not operate a continuous monitoring centre. Where needed, we help you choose and coordinate a specialist provider.
Related services
Discuss this service
Tell us briefly about the context: your deadline, what you already have in place and the result you are aiming for.
We treat every enquiry with discretion. We can sign a mutual NDA before discussing sensitive information.
If you do not use an email app, copy the address and write to us from your own account.
We use the details in your message to reply to you. More in our privacy policy.