Sets the security programme
Assesses where you stand, sets the priorities, and writes the policies an auditor will ask for: risk analysis, incident handling, business continuity, supplier security, access control.
Home / External CISO
A Chief Information Security Officer for your board, without the full-time hire.
External CISO in Cyprus · Or we recruit your own CISO and build the team
The law names your board. It doesn't name your IT provider. NIS2 and DORA make the management body approve the security measures and answer for them. An External CISO prepares those decisions and the evidence for them.
Identiqa serves companies in Cyprus as External CISO, also called CISO as a Service. We take on security governance, risk assessment, audit preparation, and reporting to your board, your auditors, and your supervisor. If you'd rather hold the role in-house, we recruit your Chief Information Security Officer, test the shortlist in technical interviews, and help build the team.
What your External CISO does.
One person your board can ask, and one person accountable for preparing the evidence.
Reports to your board
Brings the board the decisions it has to take, in language it can minute, and briefs its members on the risks they answer for.
Prepares you for audits and inspections
Collects the evidence for the Digital Security Authority, CySEC, the Central Bank of Cyprus, your auditors, and the customers who send security questionnaires.
Gives the incident report an owner
Sets up the incident procedure before it's needed: who decides, who is called, and who sends the first warning to the authority.
External CISO, or a CISO of your own?
Few companies in Cyprus need a full-time CISO, and fewer still can find one. We offer both routes, and you can move from the first to the second.
| External CISO | Your own CISO | |
|---|---|---|
| Fits when | You need the role now, and a full-time post is more than the company requires. | Security has grown into a full-time job in your company. |
| What you get | A senior security lead from Identiqa who takes the role and reports to your board. | A shortlist we have tested in technical interviews, and help building the team around your hire. |
| Who holds the role | Identiqa, under the authority of your board. | Your own employee. |
| Our part afterwards | We stay in the role for as long as you need it. | We stay at your CISO's side as advisers. |
Does the law require a CISO?
Neither NIS2 nor DORA uses the title. Both describe the job. The Cypriot NIS law makes the management body approve the cybersecurity measures, oversee them, and take part in training (Article 35A). DORA goes further for financial entities other than microenterprises and firms under the simplified framework of Article 16: responsibility for managing and overseeing ICT risk has to be assigned to a control function with an appropriate level of independence (Article 6), and someone has to monitor the arrangements with ICT providers (Article 5).
Somebody has to hold that work together and keep the evidence in order. The role can come from outside. The responsibility stays with your board.
Talk to us about the role.
Tell us what your board has been asked to show and who looks after security today. We reply to arrange a first briefing with our team in Cyprus, free of charge.
cyprus@identiqa.comCommon questions
Is an External CISO the same as CISO as a Service?
Yes. External CISO, CISO as a Service, and fractional CISO all describe the same thing: an experienced security lead who holds the role of Chief Information Security Officer for your company without being your employee.
Does the External CISO replace our IT provider?
No. Your IT provider or your IT team runs the systems. The CISO sets the rules, checks that they are kept, and reports to the board. Keeping the two apart is the idea behind DORA's control function with an appropriate level of independence.
Which companies in Cyprus do you serve as External CISO?
Companies that carry regulatory duties without a large security department: ship managers and shipping companies, investment firms and payment institutions, fiduciary and corporate service providers, and technology and gaming companies.
What does an External CISO cost in Cyprus?
The first briefing is free of charge. After it, we scope the engagement to your company and your regulatory duties and price it individually, in euro plus VAT.
The legal references here are summaries, not legal advice.