1. Services
1.1. Firewall management
1.1.1. PFSense
1.2. CISO Service
1.2.1. services
1.2.1.1. policy management
1.2.1.2. enaging with 3rd parties on infosec matters
1.2.1.3. controls assessment
1.2.1.4. managing improvements
1.2.1.5. link to SecOps
1.2.2. pricing
1.2.2.1. per reserved days
1.3. Security reviews
1.3.1. delivery
1.3.1.1. Template document
1.3.1.1.1. Excel sheet online
1.3.1.1.2. Possibly use Qualys SAQ
1.3.1.2. Remote review of responses
1.3.2. Pricing
1.3.2.1. employess?
1.3.2.2. Size of the network (systems)
1.3.3. 1st Priority
1.3.4. Technical assessments
1.3.4.1. Qualys
1.3.4.1.1. VM
1.3.4.1.2. Policy compliance
1.3.5. FAIR Institute - later
1.3.6. Benefits for auditors
1.3.6.1. translation ofg IT responses to auditor speak
1.3.6.2. highlight suspicios reposnses
1.3.7. Standards
1.3.7.1. ISO27001
1.3.7.2. NIST CSF
1.3.7.3. CIS Top 20
1.4. Security operations
1.4.1. Tools
1.4.1.1. Qualys
1.4.1.1.1. Indications of Compromise
1.4.1.1.2. Hardening assessment
1.4.1.1.3. Vulnerability management
1.4.1.1.4. Web application security
1.4.1.1.5. Services tiers
1.4.1.1.6. POC
1.4.1.2. Skybox
1.4.2. Benefits
1.4.2.1. Auditor
1.4.2.1.1. monitor complaince
1.4.2.1.2. monitor risk
1.4.2.2. CxO
1.4.2.2.1. reporting of risk
1.4.2.3. IT
1.4.2.3.1. knows what to do
1.4.2.4. Business function managers
1.4.2.4.1. knows risk to their applications
1.4.3. Selling
1.5. Cybersecurity awareness trainings
1.5.1. Online video delivery
2. Marketing
2.1. Website
2.2. Whitepapers
2.3. Presentations
2.4. Datasheets
2.4.1. Battle Card for non-managed Skybox service
2.4.2. Security Review/Assessment
2.5. PR
3. Business
3.1. Margin split
3.1.1. SW licence sales
3.1.1.1. Qualys
3.1.1.1.1. Split
3.1.1.1.2. Who does the client pay?
3.1.1.1.3. Should big be a reseller locally? Some clients will want to see local agency.
3.1.1.2. Skybox
3.1.1.2.1. Sofware
3.1.1.2.2. Gross margin 35%
3.1.1.2.3. Gross margin 10%
3.1.1.3. Edgescan
3.1.2. Reviews
3.1.2.1. X % on top of FC invoice
3.1.3. CISO
3.1.3.1. X % on top of FC invoice
3.1.3.2. base cost £1500
4. BIG
4.1. Cyber
4.1.1. Security review
4.1.1.1. questionnaire led
4.1.1.2. partially automated
4.1.1.3. Levels
4.1.1.3.1. SIlver - Basic controls
4.1.1.3.2. Gold
4.1.1.3.3. Platinum
4.1.2. Technical Assurance Services
4.1.2.1. Qualys
4.1.2.1.1. Core
4.1.2.1.2. Specialist
4.1.2.2. Skybox
4.1.2.2.1. >500, High Risk, infrastructure rather than cloud services
4.1.2.2.2. Brings organisation at maturity level 4 to level 5.
4.1.3. Incident detection service
4.1.3.1. SIEM platform with feeds
4.1.3.1.1. Server logs
4.1.4. IT Review
4.1.4.1. Tiered packages
4.1.4.1.1. Platinum
4.1.4.1.2. Gold
4.1.4.1.3. Silver
4.1.4.1.4. Bronze (?)
4.1.5. CISO as a Service
4.1.5.1. Policies
4.1.5.2. Awareness & Education
4.1.5.2.1. Retainer
4.1.5.2.2. Monthly Comms?
4.1.5.2.3. phishing tests
4.1.5.3. GRC?
4.1.5.4. ad-hoc calls