Illustrative scenario. This is a hypothetical example designed to explain a common compliance challenge and a possible engagement approach. It does not describe a specific Kellwick client, completed project or verified outcome.

Illustrative scenario · Payments

A payments firm that fixed the incident but not the governance behind it

The breach was contained and the fix shipped. What was missing was the security leadership to make sure it did not happen the same way again. A vCISO turned a one-off scare into a governed program.

Hypothetical profile: Payments company, ~110 staff, ISO 27001 certified. Strong engineers, no dedicated security leadership after an ICT incident.
Assumed timeline: Post-incident; board wants assurance it will not recur
The trigger: After an ICT incident that hit payment operations, the board wanted assurance the underlying governance gaps were owned and closed - not just the immediate technical fix. There was no security leader to own that.

The challenge

The team handled the incident well technically, but the incident exposed governance gaps: unclear ownership, uneven detection and response discipline, and no one steering security improvement against risk. Fixing the bug is not the same as governing so the class of problem is managed - and that needs leadership the firm did not have.

Potential findings

Finding 01
No owner for security governance
The technical fix had an owner; the governance improvement did not.
Finding 02
Detection and response uneven
The incident revealed gaps in monitoring and a response process that existed only informally.
Finding 03
Root-cause governance not closed
The immediate cause was fixed, but the governance conditions that allowed it were not addressed.
Finding 04
Board lacked ongoing assurance
Directors had no regular, structured view that security was improving against risk.
Finding 05
ISMS not steered against the incident's lessons
The certified ISMS did not absorb what the incident taught, because no one was steering it.

Example remediation approach

Provided a vCISO to own security governance after the incident
Turned the informal response process into a tested, owned incident-response capability
Closed the governance root causes, not just the technical trigger, with a risk-linked plan
Set up regular board assurance that security was maturing against risk
Steered the ISMS to absorb the incident's lessons and the firm's DORA incident-reporting duties

What the approach aims to achieve

The firm would turn a one-off scare into a governed security program with an owner, a tested response capability and board-level assurance - built on its ISO 27001 base and aligned to its DORA incident-reporting duties. Security leadership is provided as a service; accountability stays with the firm.

Example deliverables

Named vCISO owning security governance
Tested incident-response capability
Root-cause governance closure plan
Board security assurance reporting
ISMS + DORA incident-reporting alignment

Relevant services

The lesson

Containing an incident is not governing security. The technical fix has an owner; the governance behind it often does not. A vCISO makes sure the conditions that allowed the incident are owned and closed, not just the bug.

Find the same gaps before they become findings.

Discuss your requirements Start a Mini Gap Review

These are illustrative scenarios: hypothetical examples built from common ISO 27001 and GRC failure patterns, not accounts of Kellwick clients or completed projects. Company sizes, timelines and counts are assumptions for the example. Certification is always decided by an accredited certification body; we prepare teams for it and never guarantee the outcome.

Certification is performed by an accredited certification body through Stage 1 and Stage 2 audits. Kellwick prepares you for that process; it does not perform it and cannot guarantee its outcome.

The challenge

Potential findings

Finding 01

No owner for security governance

The technical fix had an owner; the governance improvement did not.

Finding 02

Detection and response uneven

The incident revealed gaps in monitoring and a response process that existed only informally.

Finding 03

Root-cause governance not closed

The immediate cause was fixed, but the governance conditions that allowed it were not addressed.

Finding 04

Board lacked ongoing assurance

Directors had no regular, structured view that security was improving against risk.

Finding 05

ISMS not steered against the incident's lessons

The certified ISMS did not absorb what the incident taught, because no one was steering it.

Example remediation approach

Provided a vCISO to own security governance after the incident

Turned the informal response process into a tested, owned incident-response capability

Closed the governance root causes, not just the technical trigger, with a risk-linked plan

Set up regular board assurance that security was maturing against risk

Steered the ISMS to absorb the incident's lessons and the firm's DORA incident-reporting duties

What the approach aims to achieve