Cybersecurity services the seat oversees : Every capability, one owner.
This is the mandate map: everything a regulated firm needs running, organised the way assessors organise it. The seat owns each line. It does not matter who builds or who supplies talent — Golonex, your MSP, your cloud provider, your engineers. The seat directs the work, checks it against the framework, and signs for the result. The technology estate itself — cloud, software, the Microsoft estate, process automation — runs through managed delivery.
The seat itself, and the work only the seat can do.
Virtual CISO
A named fractional vCISO on your org chart — with vCTO, vCAIO, and DPO seats under it — who owns the program, signs the evidence, and reports to the board.
Cybersecurity Consulting
Scoping, strategy, vendor selection, board briefings, and the judgement calls between assessments. The advisory layer that comes with holding the seat.
Security Program Development
Building the ISMS: risk assessment, Statement of Applicability, control design, the policy set, and the operating rhythm that keeps it alive.
Governance, Risk & Compliance
Board-approved policies, the risk register, committee charters, board reporting, and the vendor-risk toolkit.
Third-Party Risk Management
Vendor questionnaires, contract clause library, annual reviews, and flow-down of NIST 800-171 obligations to your subcontractors.
Readiness reviews. Golonex prepares you; the assessor grades you.
Assessment Services
Gap assessments scored against the framework — CMMC / NIST 800-171, EU AI Act, ISO 42001, ISO 27001, PCI DSS — with the SSP, POA&M, and evidence pack that follow.
Penetration Testing & Phishing
Continuous attack-surface monitoring, periodic manual penetration testing with named testers, and monthly phishing simulation with evidence.
The day-to-day. Delivered by Golonex or by the vendor you already have, overseen by the seat either way.
Six offers that build and run the work the seat directs.
Managed talent, managed software delivery, managed infrastructure, security assurance, the managed Microsoft ecosystem, and managed process & AI automation — a named engineer or a dedicated team for each, sized to the service, with one accountable lead and one monthly report, at a fixed monthly price per seat. Golonex does not resell or operate security products.
Security assurance →Cybersecurity Monitoring & Surveillance
Run by your SOC or monitoring vendor. The seat verifies coverage, retention, and that someone acts on what is found.
SOC Services & CyberOps
Golonex does not operate a SOC. Your SOC vendor runs it; the seat holds them to the framework and the escalation tiers.
Managed Detection and Response
Run by your EDR / MDR vendor. The seat checks every in-scope device is enrolled and reporting, and that alerts reach a person.
Digital Forensics
Golonex does not provide incident response or forensics. The seat makes sure a retained specialist, a plan, and the notification clocks are in place before they are needed.
Managed IT Security Services
Identity, endpoints, email, backup, cloud, and configuration — run by your vendors or managed infrastructure, and proven to work by security assurance.
Security Products
Golonex does not resell security products. Where a product you run does not meet the framework, we say so in writing and recommend a replacement with the reason.
People are a control. The evidence has to say so.
Security Awareness and Education
A managed awareness programme — phishing baseline, monthly simulation, role-based modules, and completion records formatted for the evidence pack.
Training
Cyber and AI-literacy training with attendance evidence — for ISO 27001, CMMC awareness, and EU AI Act Article 4. Delivered via Genbay.
Independence
Prepared by us. Assessed by someone else.
Golonex prepares you for CMMC assessment, and an independent C3PAO performs it. Registered Practitioner (RP) registration with the Cyber AB in process. The same separation holds for the QSA on PCI DSS, the certification body on ISO, and the licensed CPA firm on SOC 2. It is what makes the evidence credible — the firm that prepares you is never the firm that grades you.
When the seat says build
Managed software delivery.
Readiness surfaces work that has to be engineered — evidence pipelines, secure workflows, integrations, automation. When you want Golonex to build it, there are three ways: a dedicated managed team, a fractional engineering lead with a team, or a fixed-scope build. Fixed monthly pricing by seat for teams, a fixed price per milestone for builds. When you want someone else to build it, the seat oversees that too.
Managed software delivery →Not sure which lines apply?
Thirty minutes tells you what you owe, what it takes, and exactly what we stand behind.