IT security, right-sized
Six services around information security for Swiss SMEs. More protection, fewer tools, less cost.
Six services, one principle
Security leadership, consulting, ISMS and assessment. One thread runs through all: more protection, fewer tools, less cost.
Interim & Fractional CISO
Security leadership without a full-time hire. Operational responsibility on a mandate basis, 1 to 4 days per week, we stay until it is done.
Learn more →Security Management & Operations
Full security expertise as consulting. Senior support on specific topics while your IT leadership stays in charge.
Learn more →ISMS & ISO 27001
Information security that works in daily operations. From assessment to certification readiness, no paper tiger.
Learn more →NIS2 Training for Executive Management
In-house training under Sec. 38 BSIG and the Austrian NISG 2026. Duties and liability, your own risks, a rehearsed crisis and documentation for the record.
Learn more →Security Assessment with Implementation
No shelf reports. A prioritized assessment with measures that actually get implemented, measured by business risk. At a fixed price.
Learn more →AI Governance & Secure AI Adoption
Use AI without losing control over your data and knowledge. Usage policies, AI risk analysis, nDSG-compliant adoption and, on request, an AI management system based on ISO/IEC 42001.
Learn more →Who we work with, and where it actually hurts
The reasons a company hands security to someone outside rarely have much to do with the law. Usually it comes down to capacity, customers and budget. Here is what that looks like in your industry, and which of our services actually moves the needle there. Every industry also has its own page with the full picture.
Manufacturing & Industry
Swiss engineering and metalworking firms are still waiting for a recovery. In Swissmechanic's May 2026 business barometer, about three quarters rate their business situation as unfavourable, the business climate index sits at around minus 30 points, and four in ten firms saw falling EBIT margins in the first quarter of 2026. In a year like that, no board signs off a new full-time security position. The demands arrive anyway: large customers send supplier questionnaires, insurers attach conditions, and on the shop floor control systems and office IT are growing together.
Typical trigger: A major customer sends a security questionnaire with a deadline, and nobody inside can answer it.
What we find in these companies
- Security sits with the IT lead who already carries everything elseOperations, ERP, projects and support run through the same person. Security is not in bad hands there. It is simply the task that always comes last.
- Customer questionnaires decide who gets the orderIf you cannot evidence supply chain, emergency planning and access control, you drop off the bidder list before anyone talks about price.
- Machines run for 15 years and moreControllers on old software versions cannot simply be updated, because the vendor has not approved it or the line would have to stop.
- The toolset grew, it was never designedFirewall, endpoint protection, backup and monitoring come from different years and overlap. With margins shrinking, that is real money buying no additional protection.
- One day of downtime costs more than the annual security budgetThat is the real argument on a shop floor, and it is a commercial one, not a regulatory one.
Why these services fit
Assigned responsibility without creating a position
A mandate of one to four days a week costs a fraction of a permanent CISO and can be scaled back once the programme stands. That is the cost structure a board will approve even with headcount frozen.
Your IT lead keeps operations. We take on security leadership, prioritisation and reporting to management and the board.
Count what you already have before you invest
At a fixed price we measure maturity, surface duplicate licences and prioritise by business risk rather than product catalogue.
In most companies what gets cut pays for a good part of what is missing. That is why this service comes first, not last.
The questionnaire becomes an answer that is already on file
An ISMS answers customer and audit questions once, in a structured way, instead of assembling them from scratch each time. Supply chain and NIS2 requirements from EU customers are covered with it.
The certificate is the visible part. The practical benefit is that sales no longer waits for IT.
Energy & critical infrastructure
Around 600 utilities supply Switzerland with electricity. The median distribution grid operator serves just under 1,500 end customers. So the typical Swiss utility carries the duties of a critical infrastructure operator with an IT team of a handful of people. On top of that, grid costs are regulated. Security cannot simply be financed through the tariff, it has to be justified and correctly sized.
Typical trigger: The board or the owning municipality asks about the state of cyber security, and there is no defensible answer.
What we find at utilities
- Critical infrastructure duties, SME resourcesThe requirements were written for operators with dedicated staff functions. They have to be met by a team that also runs the control room, office IT and the customer portal.
- Control technology and office IT are convergingTelecontrol, smart meters and vendor remote-maintenance access now sit on the same network as mail and ERP.
- Remote access nobody fully knows aboutSuppliers have been given access over the years. Who can reach what today is rarely documented properly.
- Regulated costs, unregulated expectationsEvery franc spent on security has to stand up to the regulator and the owners. Buying a tool is easier than explaining why it was needed.
- Mandatory reporting assumes a rehearsed processSince April 2025 critical infrastructure operators must report cyber attacks. In many places the process behind that exists only on paper.
Why these services fit
Structure sized to the organisation you actually are
We build the ISMS along ISO 27001 and the Swiss ICT minimum standard, with asset inventory, protection requirements and a supplier overview.
The scope matches 1,500 end customers, not 150,000. A system your team can actually run is worth more than one that impresses an auditor and then nobody.
Remote access and suppliers back under control
We bring order to access, permissions and vendor maintenance, and establish measure tracking that works during normal operations.
Your people stay on the grid. We work off the backlog without the supply suffering for it.
A named responsibility that can also report
For the board, the municipality and the regulator what counts most is that someone can explain the security position in business language and justify the spend.
We take that on as a mandate, with experience from regulated environments and without you having to create a position.
Financial services
Since the Financial Institutions Act, independent asset managers and trustees are supervised by FINMA as well. Most of them are micro-businesses with fewer than five full-time positions. They have to meet expectations on operational risk and outsourcing that were written for institutions with their own staff functions. On top of that, custodian banks run their own due diligence on the asset managers they work with, with their own questionnaires and their own deadlines.
Typical trigger: The custodian bank or the auditor asks for evidence on IT security and outsourcing, and there is nobody inside who can produce it.
What we find at financial firms
- Requirements built for large institutions, a team of fiveWhat is a staff function at a bank is an extra job for someone whose actual work is looking after clients.
- The IT is outsourced, the responsibility is notAn external provider runs the systems. Towards the regulator, the custodian bank and your clients, you are still the one answering.
- Payment approvals run over mail and phoneThat is exactly where payment fraud starts. Business email compromise was the second costliest fraud category in the FBI IC3 2025 annual report, with around USD 3 billion in reported losses across 24,768 complaints.
- Compliance costs grow with nobody saying when it is enoughWithout a reference frame, every new requirement is answered with another tool or another mandate.
- Discretion is the actual productAn incident that becomes public rarely costs systems. It costs mandates.
Why these services fit
Built once, it serves all three audiences
Regulator, custodian bank and clients ask essentially the same things in different formats. An ISMS delivers the evidence in a structured, reusable form.
Every further request becomes routine instead of a special project that blocks half the firm.
Due care that is documented and provable
We take on the named security responsibility and deliver reporting in business language for the board, auditors and the regulator.
That includes the things small institutions most often fall down on: payment approval processes, vetting of IT providers, and an incident plan that actually exists.
Know where you stand before the next budget is signed
A fixed-price assessment shows where you sit against recognised frameworks and which measures actually have an effect.
That is the basis for capping compliance spend instead of rolling it forward every year.
Healthcare & Life Sciences
Swiss acute care hospitals reached an EBITDAR margin of 6.8 percent in 2025. That is better than in previous years, but still clearly below the roughly ten percent needed to self-finance investment. The net margin was back in positive territory for the first time in years, at 1.0 percent (PwC hospital study, July 2026, fiscal year 2025). In plain terms: it is enough to operate, not enough to invest. A security budget in that situation competes directly with medical equipment and staffing. To move anything here you have to argue in downtime and operational risk, not in threat scenarios.
Typical trigger: An incident at another institution, an audit finding, or a tender that demands security evidence.
What we find in healthcare
- Every franc has to be justified against equipment and staffSecurity only wins that comparison when the benefit is expressed in downtime and operational risk.
- Medical devices cannot simply be updatedSoftware versions are vendor-approved. An update on your own initiative can affect the device's certification.
- Operations run around the clockMaintenance windows barely exist. Every change has to fit the clinical routine, not the other way round.
- Many professions, shift work, high turnoverShared logins are not carelessness. They appear because the process at the bedside has to be faster than the login.
- Patient data with evidence duties, but no dedicated roleResponsibility ends up with the IT team that is already at its limit.
Why these services fit
A known amount instead of an open consulting bill
At a fixed price, and the result is a prioritised roadmap with measures that actually get implemented.
In an institution where every expense must be justified, predictability is an argument in itself.
Relief for IT, not another load on it
We take on security responsibility instead of leaving it with a stretched IT team, and align measures with clinical operations.
Senior experience on the days it is needed, without another full-time line in the staffing plan.
Protection requirements and evidence, without slowing care
We assess protection requirements and risks along the care processes and document them so the evidence holds up with regulators and partners.
Data protection under the revised Swiss FADP is built in rather than bolted on.
Clear rules before patient data flows into AI tools
Speech recognition and documentation assistants are in use in many institutions faster than the rules covering them.
We clarify which tools are permitted, which data may go into them, and how that is documented.
Retail & Logistics
Swiss retail is only growing in part of the assortment. In the first half of 2026, total nominal turnover rose 1.2 percent according to the Swiss Retail Federation, and bricks-and-mortar retail 1.0 percent. Food grew 3.8 percent while bricks-and-mortar non-food shrank by 3.3 percent. Price competition and margin pressure sit at the top of the industry's worry list. At the same time revenue depends directly on IT: tills, warehouse, web shop and dispatch. An outage here does not stop a project, it stops the business.
Typical trigger: An outage in your own operation or at a logistics partner, or a major customer writing security requirements into the framework contract.
What we find in retail and logistics
- Many sites, each one slightly differentStores, warehouses and branch offices grew over the years. What applies in one building does not apply in the next.
- High turnover and seasonal staffAccounts are opened quickly and rarely closed cleanly. After two seasons nobody knows who still has access.
- The cloud environment grew, it was never set upThe baseline settings in M365 date from the migration. Nobody has deliberately reviewed them since.
- An outage costs revenue from the first minuteTills, warehouse and web shop hang together. There is no grace period in which you calmly restore.
- The margin leaves no room for security that returns nothingWhere non-food turnover is shrinking, every expense has to either reduce risk or replace another cost.
Why these services fit
Bring every site to the same standard
We harden M365 and cloud, tidy up identities and set conditional access so that store operations and security work together.
One standard across all sites is also the cheaper operation: fewer special cases, less support effort, fewer licences that only one location needs.
Make visible what actually stops the business
We assess along the processes that carry revenue and prioritise by impact on operations rather than technical severity.
The result is an order of work a CFO can sign off on.
One target picture instead of many single measures
We run a security programme with a clear target picture and coordinate delivery across regions and teams.
Progress becomes measurable instead of disappearing into individual projects.
Technology & Software
In software and IT companies the customer's security questionnaire often decides the deal earlier than the product does. If you cannot show an ISO 27001 certificate in a tender, you are filtered out in pre-qualification without ever presenting. At the same time security is nobody's full-time job internally. The CTO answers the questionnaires personally, and those hours are missing from development.
Typical trigger: An enterprise deal is stuck in vendor review and the customer wants evidence rather than assurances.
What we find at technology companies
- The questionnaire is the real obstacle to the saleIt is not the feature that decides, it is whether you can evidence access control, backup, incident response and supplier management.
- Without a certificate you are not even invitedIn many tenders ISO 27001 is an admission criterion, not a scoring question.
- Security work eats development timeEvery questionnaire ties up senior engineers for days. That time is missing from the product and it is the most expensive time in the company.
- Fast growth, accumulated security debtAccess, environments and the separation of development and production grew with the team, without anyone reorganising them.
- AI in the product and in daily development, without rulesWhat may go into models and assistants and what may not is rarely defined. Customers now ask about it directly.
Why these services fit
The questionnaire becomes a certificate
We build a lean ISMS and take you to certification without loading a process apparatus onto the engineering team.
The sales cycle shortens because vendor review no longer starts from zero on every deal.
Someone who holds up in the customer's security review
Where it helps, we sit in the vendor review and answer the technical follow-up questions with the necessary experience.
Your engineers stay in engineering, and the customer gets a counterpart who speaks their language.
Rules for AI that do not slow your team down
We define which data may go into which models, how customer data stays protected, and how that is documented towards customers.
On request as a management system to ISO/IEC 42001, when customers want the formal proof.
Sources for the industry figures, always the most recent edition available: Swissmechanic business barometer (May 2026), VSE on the structure of Swiss electricity supply, PwC hospital study (July 2026, fiscal year 2025), Swiss Retail Federation on the first half of 2026, and the FBI IC3 2025 annual report. As of August 2026.
The principle
Right-sizing security spend
Not a separate service, a principle that runs through every mandate. Many companies have accumulated security tools and licenses over the years that overlap, go unused, or solve problems they do not have. At the same time, basic low-cost measures are often missing.
Book a call →The first step in every mandate
- What do you already have?
- What of it works?
- What can we cut or consolidate?
- Where is basic protection missing?
- The result: better protected and spending less
What clients and partners say
AI governance is where it starts. Next comes the work that stops.
In our experience, companies that have AI under control soon want more of it. Our AI services build and run the workflows that repeat every week in your business. With the guardrails you know from security.
Frequently asked questions
What management, IT and boards ask before a security mandate.
Which companies is a security mandate right for?
For Swiss SMEs with 50 to 500 employees and no full-time CISO. Typical triggers: an incident, a customer questionnaire, the ISMS deadline under the ISG by the end of 2026, ISO 27001 as a customer requirement, or the feeling of spending too much on security without an overview. Our contacts are management, IT leads and the board of directors.
What does IT security cost an SME?
Often less than you spend today, just distributed differently. In our experience the money sits in overlapping tools and unused licences while basic protection is missing. That is why every mandate starts with the question of what can be cut.
Guide prices: the Fractional CISO from CHF 2'400 a month as sparring and from CHF 4'900 as a retainer, the Security Assessment at a fixed price that we name in the intro call. All prices excl. VAT, the quote follows after the call.
Do we need our own CISO?
In our experience a full-time position only pays off from several hundred employees or in heavily regulated industries. The role is still needed: someone who sets priorities, steers the provider and reports to management. We take that on as Fractional CISO, from one day a month to several days a week. Your IT lead keeps running operations.
When does an SME need an ISMS or ISO 27001?
When someone asks for evidence. Today that means large customers with supplier questionnaires, EU customers with NIS2 obligations, insurers, and in ISG-regulated sectors the law, with a deadline at the end of 2026. An ISMS answers these questions once, in a structured way. You only need the certificate when a customer or a tender explicitly requires it. A documented, verifiable status is often enough.
What is the first step after a security incident?
Contain it before anyone cleans up. Call us, we help immediately, even without an existing mandate: Cyber Emergency. Then isolate systems, block access, secure evidence and check the reporting obligation, which has applied to critical infrastructure since April 2025. Only once operations are running again comes the assessment that closes the gap the attack came through.
What sets ODCUS apart from a classic security consultancy?
Three things. The person you meet does the work, from the intro call to the handover. We do not sell tools and take no commission, recommendations follow fit. And we right-size: most companies do not have a security problem, they have a sizing problem. That is why the first question is always what can be cut.
Can we keep our IT provider?
Yes, and usually that is the right call. We take the lead on security, your provider stays responsible for operations. We tell them what comes first, check what gets delivered and translate for management. We only recommend a change if they cannot or will not deliver the basics, and even then without a replacement of our own on offer.