Cybersecurity

What it is

Through TutumSec, the BDR Group business vertical specialising in cybersecurity, we protect your company against today’s and tomorrow’s digital threats.

We do not see cybersecurity as an isolated cost, but as a competitive advantage. We offer everything from outsourced CISO consulting (vCISO), security audits, pentesting and incident response to 24/7 monitoring services (SOC) and regulatory compliance (ISO 27001, NIS2, GDPR, ENS).

What it brings to your business

• Proactive protection: detection of vulnerabilities and threats before they cause damage.
• Regulatory compliance: alignment with ISO 27001, NIS2, GDPR and other regulatory requirements.
• 24/7 monitoring: a SOC (Security Operations Center) that watches over the proper functioning of your systems.
• Fast response: a team specialised in incident response (DFIR) if something happens.
• Team training: awareness and training so that security does not depend on technology alone.

Who it is for

For companies that handle sensitive data, operate in regulated sectors, or simply want to sleep easy knowing that the security of their information is a priority. From SMEs to large companies that want to go from "I think we are protected" to "I know we are protected".

We work from Barcelona, Girona and Andorra, and we serve the whole of Spain. The group has experience with more than 1,000 companies in Andorra, Catalonia and Spain in sectors such as retail, hospitality, construction, tourism and professional services.

What is included

• vCISO (CISO as a service): strategic governance, dashboards and data-driven decisions.
• Strategic consulting: a comprehensive diagnosis and a roadmap with quick wins.
• Technical audit and compliance: we assess the real state of your security and compare it with NIS2, ENS and ISO 27001, with an improvement plan.
• Pentesting: penetration tests to give you a realistic view of the risks, including in IT and OT environments.
• Monitoring and response, 24×7 SOC/MDR: detection and response to threats.
• Incident response (DFIR): a specialised team to act when something happens.
• Information Security Technical Office (OSI): to support NIS2 compliance.
• Training and awareness: programmes so that people are part of the defence too.

How we work

1. Initial diagnosis. Technical audit, pentesting and gap analysis against NIS2 and ISO 27001.
2. Strategic roadmap. A 12 to 36 month plan with priorities and return on investment.
3. Implementation and governance. Policies, processes and tools adapted to your company.
4. Ongoing follow-up. Rollout, indicators and a quarterly review with your vCISO.

If you would like a first contact, we offer an initial 30-minute consultation at no cost. And if you prefer to start with your domain, the free diagnosis consists of a 5-minute questionnaire and a preliminary report, reviewed by a TutumSec consultant, that you receive by email within 24 working hours.

Frequently asked questions

Do you serve the whole of Spain?

Yes. We operate from Barcelona, Girona and Andorra, and we serve the whole of Spain.

How long does a full audit take?

Between 2 and 4 weeks, depending on the scope.

Can I hire just one service, for example the audit?

Yes. We work with modular, scalable services, so you only pay for what you need.

Do I have to change my infrastructure?

Not always. We prioritise quick-win measures.

How can I comply with NIS2?

We start with a diagnosis of your situation and a roadmap with priorities. Our information security technical office supports NIS2 compliance.

What does the free diagnosis include?

A preliminary report based on what can be observed about your domain on the internet (DNS, website and email configuration) and on ten self-assessment answers. It includes an executive summary, strengths, findings and recommendations in order of priority. It is a first orientation to know what to prioritise, based on passive reconnaissance of the domain: it does not replace a full audit or a pentest.

More information

All the cybersecurity services are at TutumSec: cybersecurity consulting and regulatory compliance for businesses. You can start with the free cybersecurity diagnosis for businesses.

Related pages: IT systems and consulting and Business cloud.