Qualifications and memberships
You will not find client names on this website. You will find what we can prove — qualifications, memberships and the limits where our competence ends.
Why this is not a references page
Consulting firms tend to introduce themselves with client names. We do not, and that is a decision, not a gap — the reason is set out in the code of ethics.
Instead, this page sets out what can be verified without exposing anyone: what we are qualified in, where we belong and where our competence ends.
Qualifications
Milan Mračko — managing director. More than 20 years of audit practice. Lead auditor for ISO/IEC 27001 and ISO 22301, with ERCA and CQI qualifications. Also performs audits for certification bodies — that is, for the organisations that issue certificates.
IOSEC Slovakia has five lead auditors for ISO/IEC 27001 of its own.
Two cooperating certified cybersecurity auditors under the Slovak Act No. 366/2024 Coll.
Memberships
Cybersecurity community — since 30 June 2026.
The application of IOSEC Slovakia was assessed favourably by the National Coordination Centre Slovakia under Article 7(1)(i) of Regulation (EU) 2021/887 of the European Parliament and of the Council. The application includes a security assessment.
The membership is recorded in the register of community members at the European Cybersecurity Industrial, Technology and Research Competence Centre (ECCC), and the organisation is listed in the European Cybersecurity Atlas — the European Commission's platform that maps organisations active in cybersecurity.
Where our competence ends
This is not small print. These are limits we state before anyone asks.
- Certificates under ISO/IEC 27001 and ISO 22301 are issued by an accredited certification body. The same organisation may not both build a system and certify it. We prepare and accompany; the assessment is performed by someone else.
- A TISAX assessment may only be performed by a provider accredited by ENX. We are not one.
- In Austria, the demonstration of compliance under NISG 2026 may only be performed by an unabhängige Stelle established in Austria or in another EU member state, through an auditor admitted by the Austrian authority (Section 7 NISG 2026). We are not on that list.
- We are not a notified body under the AI Act and do not issue certificates under it.
- In personal data protection we provide advice and act as data protection officer. Under a power of attorney we represent clients in dealings with the Slovak supervisory authority, Úrad na ochranu osobných údajov Slovenskej republiky, and in handling requests from data subjects. The scope of representation is agreed case by case. This is neither legal advice nor representation by a lawyer.
- Operational technology we assess by agreement, depending on the scope of the requirements.
Tell us what you are dealing with.
Thirty minutes with a consultant who knows your industry. The output is a one-page summary with a recommended approach and an indicative scope — we send it to you even if we do not reach an agreement.