You can outsource a security role. Not the responsibility

Why is the role so hard to fill?

Because it is not a single specialism but the intersection of several. A cyber security manager has to understand technology well enough to assess measures, processes well enough to introduce them, and regulation well enough to hold their own in dealings with the authority. People who combine all of this are scarce on the market, and a company that finds such a person usually does not need them full-time.

This creates a trap: the obligation cannot be divided, but the work comes in bursts. It peaks when measures are introduced, during an audit and during an incident, and in between it is mostly maintenance.

What does the role actually involve?

Four different jobs that are commonly hidden under one name. The security manager runs the whole area: decides on measures, handles incidents, is responsible for regulatory compliance, deals with the authority and convenes the committee and training sessions. The architect looks at the technology, that is, the ICT environment and networks, writes standards and is usually involved in audits and tenders. The auditor sits on the other side of the table: verifies where the company really stands and guides it towards ISO 27001 certification. The DPO is in charge of personal data, that is, the record of processing activities and the contracts with those who work with the data.

Which of them you need, and to what extent, depends on which obligations regime your organisation falls into. That, incidentally, is why you cannot start with recruitment: until the classification is clear, the brief for that person is not clear either.

What does outsourcing look like in practice?

Like an ongoing function, not a consultation. Governance means that the role is filled externally and, month after month, the same work is done for the customer that an employee would do: preparing or revising controlled documentation, communicating with NÚKIB, organising the cyber security committee, training employees and suppliers, and reporting to management.

What makes it tangible is what it leaves behind in the company:

• An asset map and a risk register, that is, an overview of what you are actually protecting and from what.
• A statement of applicability: which measures are in place, which are not, and why.
• An implementation action plan setting out the order of the steps.
• Business continuity and recovery plans in case something happens.
• The cyber security manager’s records, which are used during an inspection to show that the work is being done.

These documents are what remains yours even when the supplier changes. That is precisely why, when choosing one, it is worth asking about them before asking about the hourly rate.

What cannot be outsourced?

Responsibility. The statutory obligations remain with your organisation, whoever actually fulfils them, so outsourcing the role does not transfer the risk to the supplier. It is a way of getting the work done, not a way of getting it off your plate.

Nor can knowledge of your operations be outsourced. An external security manager knows what ought to be in place, but what is actually running in the company they can only learn from your people. Companies for which this does not work usually have one thing in common: nobody on the inside has time for the collaboration, and the documentation then describes an environment that exists only on paper.

What should you ask before outsourcing the role?

Four things, and none of them is the hourly rate. Who exactly will lead the role for us, and will we get to see that person or just the company name. Who will stand in when they are unavailable, because an incident does not wait for the holidays to end. How many days a month are allowed for, so that the work does not stall for lack of capacity. And what of the collaboration stays ours, that is, whether the documentation is created on our side or in the supplier’s template, which they take away when the contract ends.

A fifth question is uncomfortable and worth asking: what happens if your management decides differently from what the role recommends. A good answer is that both the recommendation and the decision are put on record. That is what distinguishes a role that is responsible for delivery from an adviser who is responsible for an opinion.

When does recruitment make more sense?

When the work is so extensive that an external role would run full-time anyway, or when the environment is so specific that someone needs to look at it every day. Typically larger organisations with their own IT department, where the security manager is not the only one who understands the subject.

The third case is a company that has already had an external role once and ended up with documentation describing someone else’s environment. Changing supplier will not help there: first, the company has to decide internally who answers on its behalf the questions about what really runs in it.

A combination is the most common: your own person for operations and an external role for compliance, audits and dealings with the authority. What such dealings look like and which deadlines apply is covered in the article on the Cyber Security Act; role outsourcing and governance are provided by Securent, while monitoring of infrastructure and end devices is handled by ICT services.