Consulting
ServicesYour partner for a safe, secureand sustainable future

Digital trust

Inspiring trust for a more resilient world.

awaren

Vulnerability management

Phishing simulations

Incident management

Social engineering

Penetration testing/Red teaming

Certified information
security courses

inintraOnsite and bespoke courses

Third party security/risk assessment

Online interactive solutions

Legal tech

Accredited Cyber Lab(CAS, CPA, CTAS)

nm
an

Data subject requests(DSARs) supportag

DPO as a service

entandp ri v

ac yic e sISO/IEC 27001, SOC 2

Data protection assessment
Internet of Things (IoT)

v isati oDigital forensics
Data protection (GDPR)em

PCI DSS, NIST framework

GDPR verification

Cli aomp

oreDiscovery/eDisclosureg

Virtual CISOerv

Cybersecuri

End user awarenessndsaesty Cloud security solutions

I nf o r m

BSI’s global expertise and services enable ourclients to better respond to cyber threats andbuild more resilience around their criticalinformation and IT infrastructure, protecting theirinformation, people, and reputation. We enable astate of enhanced and sustainable information
resilience through our integrated services in theareas of cybersecurity, security awareness andtraining, information management and dataprotection, compliance, and data risk advisory
services.

Security

cesiv
rseysDigital trustnaced

How cybersecurity expertise from BSI helps
Information Resilience, a domain of Organizational Resilience, empowers organizations tosafeguard their information – physical, digital, and intellectual property – throughout its
lifecycle, from source to destruction. This requires the adoption of information security-mindedpractices that enable stakeholders to gather, store, access, and use information securely andeffectively.
Achieving Information Resilience requires four interconnecting subdomains to be addressedwith strategies, plans, and actions.
1. Cybersecurity
2. Information management and privacy
3. Security awareness and training
4. Compliance to requirements
Digital trust helps your organizations achieve this state of enhanced and sustainable
Information Resilience through its integrated and woven sets of products and services:• Cybersecurity: With the proliferation of data breaches and malicious attacks, organizations
need to employ the most proficient and best-in-class cybersecurity strategy available.
This ranges across a broad spectrum of testing and vulnerability management services,from penetration testing to gold standard Red Teaming (CREST approved). Within theseservices, BSI also provides a host of cloud security solutions, from web security and cloudaccess security brokerage, to identity access management and data protection in the cloud.
• Information management and data privacy: With the initiation of GDPR, privacy managementand data protection has never been under so much scrutiny. Organizations need to becompliant, transparent, open, and fair in what they do with personally identifiable information(PII). Organizations need to have controls in place for how they acquire information (do theyhave consent?), use data (do they have permission?), and archive and destroy data (the rightto be forgotten and erasure). When an organization suffers a breach, BSI provides forensic
capability to identify where the breach occurred and if the data was compromised.

• Security awareness and training: Untrained employees are the weakest link in your cybersecurity
defense. According to research, 91% of cyber attacks start with a phishing email. BSI implements
robust, agile, and compliant training modules and courses to ensure that your weakest link
becomes your strongest asset in remaining vigilant and resilient to the omnipresent threats.
Additionally, BSI offers bespoke, customized, online, in-house, and classroom-based certified
training across a mix of information security, cloud security, and data protection courses.
• Compliance regulations: With support for PCI DSS to NIST framework, Cyber Lab certification
to ISO 27001/27701 implementation, and HIPAA to SOC 2 services, BSI enables organizations toensure compliance through our knowledge of the standards and regulatory landscape and highly
experienced teams of consultants.

As a leading provider of research and development, auditing
services, training, data compliance, managed technology
solutions, and advisory services, BSI can help you embeda robust framework to build information resilience andproactively reduce and respond to cyber threats.
Our services include:• Cybersecurity• Security testing• Outsourced data protection officer (DPO)• Compliance services• Cloud security• PCI DSS consulting services• Incident management• ISO/IEC 27001 consulting servicesand SCO 2• Information risk management• Security awareness and training• Accredited cyber lab• End-user security awareness• Data protection impact assessment (DPIA)• Phishing simulations• Compliance services• Social engineering• Cyber risk advisory services• Certified information security courses• Information management and data protection• Security program development• Security program project management• eDiscovery and digital forensics• Strategic remediation planning• Data subject access requests (DSAR)• Cloud provider assessment• Data protection (GDPR)

Securitytesting
Given the cyber threat landscape, organizations
need the correct protocols, policies, and proceduresin place to keep their information safe, data secure,and infrastructure robust, and to ultimately enable
an enhanced state of resilience.
Security testing involves many facets when
testing an organization’s infrastructure andestate. Testing capabilities can vary across manydifferent domains, such as network, mobile/web
applications, and infrastructure. Security testing is
the art of utilizing offensive testing techniques toverify the effectiveness of existing security controls,and verifying the full impact of any identified
vulnerabilities should they be exploited by amalicious attacker.

How security test guidance from BSI helps
To beat a hacker, think like a hacker. BSI uses the very same Tactics, Techniques, andProcedures (TTPs) used by malicious actors as observed in real-world breaches. CREST
approved and PCI ready, our objective-based, scenario-driven methodologies are real security.
The BSI Security Testing Maturity Framework (outlined below) can be used to help identify themost effective security testing level for your organization. The framework marries the security
maturity of an organization with its appetite for risk to identify the optimal level of testing andprovide the best return on investment.

Security Testing Maturity Framework

Foundation –vulnerability
assessment
This is the first step on thejourney to improving yourinformation security maturity
and creates the initial technicalbaseline from which to build on
your security program.

Focused –penetration testing

Resilient –attack simulation

This level is for organizations
with a growing security
capability that are looking toidentify and achieve security
improvements. This should alsoalign with the organization’srisk appetite.

This level is for organizations
with an established security
function that are looking forholistic assurances acrosstheir business regarding theirsecurity posture.

Respond to cybersecurity threatsby building resilience around criticalinformation and your IT structure. BSI
can provide you with technical andconsulting expertise to help you meetyour business goals.
Penetration testing services include:• Internet Infrastructure Testing, DNS Config Reviews, and Web
Server Config Reviews• Attack Simulation: Physical Security, Red Team, Blue Team,and Config Reviews• Containers Orchestration and Microservices: Docker andKubernetes• Social Engineering: Phishing and Pretexting• Internal Penetration Testing including Objective Based Testing,Segmentation & Microsegmentation Testing, and Wireless• Application Testing: API, Mobile, POS, and Web• Hardware: IoT and Medical Device

Cyber, risk,and advisory
services
While companies are still trying tounderstand and comply with significant
changes in global privacy regulatory
and other compliance landscapes,
they should anticipate more as therapid change in the global regulatoryenvironment continues.
Our Cyber, Risk and Advisory (CRA)
services encompass a broad range ofconsulting and compliance to regulation
services, including data protection,
privacy management, and General Data
Protection Regulation (GDPR)/California
Consumer Privacy Act (CCPA) services.
Our compliance services range from PCI
DSS to ISO27001/27701 implementation
to HIPAA and SOC 2 advisory services.

How cyber, risk, and advisory services from BSI help
Since GDPR and the recent changes in the global privacy landscape, privacy
management and data protection have never been under so much scrutiny.
Organizations need to be compliant, transparent, open, and fair with what they
do with PII. And they need to have controls in place for how they acquire, use,archive, and erase data. BSI’s Privacy Practice supports organizations with theirprivacy and data protection compliance journey.
Our team consists of industry certified and experienced privacy leaders,consultants, and project managers. We help embed privacy and data protection
at the heart of the organization’s culture and operations. In a rapidly evolving
global regulatory environment, our practitioners will keep you up to dateon all the latest developments and manage the impact of changes throughsupporting the organization with its regulatory risk profile. Additionally, in aworld ever more empowered by the cloud, our consultants possess the unique
skillset and ability to comprehend IT infrastructure and security issues that
directly impact the privacy rights of individuals.

Ensure your compliance to regulations. Across allindustries, regulatory compliance requirements arebecoming more demanding and complex. Legislation
is evolving, bringing increased accountability fororganizations that are already heavily regulated.
BSI can help.

Our services include:• PCI DSS audit and consultancy: BSI has a global
PCI DSS presence and our PCI Qualified Security
Assessors (QSAs) verify that the standard is being
adhered to and ensure that organizations truly
realize the return on security investment thestandard provides.

• NIS Directive: If your organization is involved withthe provision of essential services in the energy,transport, healthcare, drinking water, or digital
infrastructure sectors, you may be classified
as Operators of Essential Services (OES). We
help you interpret the Network and Information
Systems (NIS) Directive so you can understand if
the regulations apply to your business.

• ISO 27001 consultancy: Our consultants will
help you prepare for ISO 27001 certification,alignment or implementation of the Information
Security Management framework, writing policies
and procedures to support the ISMS, or advisingon how to implement security controls to reduce
your risks to an acceptable level.

• Cyber lab services: Manufacturers and installers
have a responsibility to create secure products
and solutions, and to deliver secure services.
BSI can open new markets and place you aheadof competitors in your industry by helping you
understand the best assurance frameworks foryour organization and achieve conformance.

• SOC 2 consulting: The SOC 2 Type II attestation
report is the gold standard for service
organizations seeking to provide assurance
that their organization, products, and services
have appropriate information security and data
privacy controls. Our experts can help yourorganization reach compliance through our rangeof consulting and audit readiness services.

• Internet of Things (IoT): BSI is creating a trusted
framework to shape, share, embed, and support
innovation, and ensure the safe and reliable useof IoT applications, data, and devices. As withmany growing areas of technology, the market
currently lacks accepted best practices and clear
standards for IoT.

• Licensed and in-house training: We provide a
range of accredited training courses that canhelp you get the knowledge and skills you needto build resilience around your information
security and data management. From beginner
to advanced courses, we’ve got you covered.
Depending on your requirements, we can deliver
training in a number of ways, including:• Classroom-based training• On-site at your premises• Live virtual online training

Whatever the CRA or training requirement, speak to us about how we can help you support
your requirements.

Data management
and security
technologies(DMST) services
As data volumes and sources continue to grow at an
exponential rate, is your team prepared with a costeffective and legally defensible eDiscovery solution?
Our experts deliver comprehensive eDiscovery, digitalforensics, and litigation support services to law firms,
corporations, and government agencies. We enable
your organization to learn and adopt best practices ineDiscovery and digital forensics. You can also
benefit from best-in-class technology integration,
improvement of internal workflows andprocesses, and, ultimately, overall reduction
in discovery costs.

What is eDiscovery?
eDiscovery is a multi-step process that typically begins with a lawsuit or investigative action and involves
the preservation, collection, review, and production/exchange of electronically stored information (ESI)for evidentiary purposes. With the use of rapidly developing technology, we help your organization solve
your most difficult challenges and bring simplicity to eDiscovery and data management.

How we help with eDiscovery
Our legal, compliance, and technology experts become an extension of your team and deliver bestin-class technology to empower your organization to create efficient and defensible eDiscovery
workflows. We uncover pragmatic solutions rooted in the most advanced technology to provide
highly cost-effective and legally defensible workflows and solutions for all forms of complex
eDiscovery, regulatory, and compliance cases.

Our expertise and qualifications
We are experts delivering comprehensive eDiscovery, digital forensics, and litigation support services.

• Relativity Experts• Relativity Certified Administrator• RelativityOne Certified Pro• Relativity Processing Specialist• Relativity Analytics Specialist• Relativity Certified User
• Cellebrite UFED Certified• Masters in Digital Investigation & Forensic Computing• MBA in Laws

Respond to a Data Subject Access Request (DSAR) within ashort deadline
In today’s world, organizations generate significant amounts of material, which contain personaldata, and which will need to be collated, reviewed, and processed when responding to a DSAR.
Responding to a DSAR within the short deadline of one month can be challenging. It will require
an understanding of the request, running searches, identifying relevant documents, and redacting
sensitive data, which may not be possible to do efficiently with common IT platforms.

How DMST services from BSI help
Our team consists of industry certified and experienced technology leaders, consultants, andproject managers. We work with you throughout your security transformation journey, fromunderstanding your requirements and working with you to clarify your needs, to ensuring you
select and implement the technologies that are right for your organization and business goals.
We will support you from initial assessment to full installation, as well as provide quarterly
business reviews and monthly updates to ensure you leverage the full potential of your solution.

“It was very important to work with a partner that knows theproduct extremely well and has carried out deployments inorganizations of similar size and composition.”- Robert Early, Group Information Security Officer, UDG Healthcare PLC

Our suite of technologies include:• Zscaler: A leader in the Magic Quadrant for web
proxy/web filtering for nearly a decade, Zscaler
provides a cloud computing-based security andcompliance system built on the internet.

• McAfee MVISION Cloud: Another Magic Quadrant
leader for Cloud Access Security Broker (CASB)
solutions, organizations can leverage a single
cross-cloud platform to gain visibility into cloudusage and risks, meet compliance requirements,
enforce security policies, and detect and respondto potential threats.

• Proofpoint: Both the end user security awarenessplatform and Proofpoint’s Advanced Email Security
empower your staff to anticipate malicious attacks
and offer total protection from today’s mostsophisticated attacks.

• Druva: With back ups and O365 limitations, Druva(100% cloud native) endpoint back up delivers dataprotection and management for the cloud era.

• MediaPRO: Leverage compliance and privacy
education to help you provide security, privacy,
and compliance so you can address a more
complete threat landscape.

• Okta: Another leader in the Magic Quadrant for
Identity Access Management and Multifactor
Authentication (MFA), Okta enables easy access for
employees while allowing control for IT, who canprovide Single Sign-On to apps and support BringYour Own Device.

• Menlo Security: Menlo Security Isolation Platform(MSIP) eliminates the possibility of malware
reaching the devices of end users from key attackvectors, including web and email.

• Alert Logic: Provide the best security and peaceof mind for your business 24/7. In partnership, weoffer a new approach to help you get the right levelof security and compliance coverage.

Our services include:• Cybersecurity• Security testing• Cloud security solutions• Third-party security and risk assessment• Information risk management• Incident management• Virtual CISO
• Privacy and data services• Data protection (GDPR)• Data subject requests support (DSAR)• DPO as a service• eDiscovery and Digital forensics• Virtual CISO
• Security training• Certified information security courses• End-user awareness and phishing simulations• Online interactive solutions• Social engineering• Compliance• Cyber lab (CAS, CPA, CTAS)• Data Protection Impact Assessment (DPIA) support• GDPR verification• Network and Information Systems Directive (NIS)• NIST Cybersecurity Framework• PCI DSS Consultancy• SOC 2

Consulting Inquiries:
Email: consulting@bsigroup.com
Visit: bsigroup.com/consulting-us

Talk to us.
BSI Consulting is focused on providing ourclients with the tools and services to ensure
they are resilient and sustainable with theirenvironmental, health and safety programs,
supply chain and cybersecurity information.
We are committed to inspiring trust for a
resilient world in everything that we do,every day.

Consulting Hubs
Arizona, Scottsdale
4150 N Drinkwater Blvd,
Suite 160
Scottsdale, AZ 85251
1 800 862 4977
California, San Jose
2150 North First Street,
Suite 450San Jose, CA 95131
1 800 790 6236
Chiswick389 Chiswick High RoadLondon
W4 4AL
United Kingdom+44 345 080 9000
IrelandCorrig Court
Corrig Road
Sandyford Industrial Estate
Dublin 18
D18 C6K1+353 1 210 1711

Japan
OCEAN GATE MINATO MIRAI 3F,
3-7-1 Minatomirai, Nishi-ku, Yokohama,
Kanagawa, Japan 220-0012
New York, NYC
141 West 36th Street,
3rd Floor
New York, NY 10018
1 212 290 6323
Texas, Austin
7000 North Mopac Expressway,
Suite 200Austin, TX 78731
1 855 501 9300
Texas, Houston
1575 Sawdust Road,
Suite 165
The Woodlands, TX 77380
1 800 790 6236
Virginia, Herndon
12950 Worldgate Drive
Suite 800Herndon, VA 20170
1-800-862-4977

Inspiring trust for a more resilient world.