About us

We do risk analysis and risk management, security documentation, implementation of management systems, audits and ongoing management of the agenda.

We do two things differently from what is usual. Risk analysis and implementation are led by people who also perform audits — so they see in advance what an auditor will open first and where they will ask for evidence. And we deploy the risk management system in your infrastructure, not as a service in someone else's cloud: a risk register is a list of your most sensitive weaknesses in one place, and it has no reason to leave your network.

Who works here

We do not name our people for the same reason we do not name our clients — the reason is in the code of ethics.

• auditors and consultants for ISO/IEC 27001, ISO/IEC 20000-1, ISO 22301 and ISO 31000
• cybersecurity managers
• specialists in risk management and continuity
• specialists in personal data protection and in acting as data protection officer
• consultants for NIS2, DORA, TISAX and the AI Act

Whose figures these are

The four figures above are for the IOSEC group as a whole, in eight countries; the number of clients is cumulative since the group was founded. The work of IOSEC Slovakia s. r. o., the company that operates this website, is measured separately:

• 200+ audits performed in the last 3 years
• 50+ implementations of an information security management system in the last 3 years
• 30+ clients that went through certification, in the last 3 years

How we work

• At the start we assess the current state and tell you which parts of your existing documentation can be used and what has to be done again.
• We agree the scope and the schedule in advance. If a deadline you have been given by a customer or a tender cannot be met, we say so straight away — not three months before it.
• We hand over outputs in a form your team can keep working with, including the source data in an open format. We are not a supplier you are locked into.
• After the handover we can run the agenda on an ongoing basis, or leave it entirely to you. We do not make one conditional on the other.

What we do not do

• We do not perform penetration tests or threat-led penetration testing. We prepare the organisation, coordinate the process and review the output; the test itself is performed by an independent provider.
• We perform internal audits only where we were not the authors of the part being audited, and nobody audits their own work.
• We do not publish who we work for. No names, no logos, no case studies from which a client could be guessed. Not even when it would help us sell.

Where our competence ends

We write this openly, because for these three things the limit is set by the rules, not by our willingness:

• TISAX. The assessment itself may only be performed by a provider accredited by the ENX Association, and nobody who prepares you for it may also perform it. We prepare and accompany you; you order the assessment directly from an accredited provider.
• ISO/IEC 27001. The certificate is issued by an accredited certification body, not by a consultant — and the same organisation may not both build a system and certify it. We help you choose the body and prepare; the certificate does not come from us.
• Austria. The formal demonstration of compliance under NISG 2026 is performed by an independent body (unabhängige Stelle) through an auditor admitted by the Austrian authority; we are not on that list, so we deliver it through an Austrian partner. We hold the contract and the coordination, so you do not have to.

What we are qualified in, where we belong and where our competence ends is set out in one place under qualifications and memberships. Why you will not find client names here is explained in the code of ethics.