Peace of mind
One up-to-date list and a report instead of searching in the dark.
A role known internationally as a “fractional CIO”, with one difference: I don’t take over the IT department or its budget. I translate the board’s intent into requirements, review IT’s recommendations, and represent the client’s interests in dealings with vendors.
Questions worth knowing the answer to.
If the answer to any of them is “we don’t know”, that is exactly where I can help. I put these questions to boards, secretaries, county heads and company presidents before decisions are taken and money starts to flow.
- Who in the organisation sees all the projects, risks and deadlines on one list today?
- What do we find out about too late?
- Who represents our interests in dealings with vendors when the IT department is busy with maintenance?
- Which decisions should we not take without an independent opinion?
What you get out of it.
Better results
Projects finish in line with their goal, because someone watches the whole.
Fewer reefs and mistakes
Early warning of risks and an independent opinion before a larger purchase.
The cost of a mistake at this stage. Projects with no owner and no shared list slip quietly, and you learn of the problem when it is already expensive. An advisor usually costs less than a single badly chosen technology, a single wrong vendor or a single trap in a contract.
Somebody has to keep watch over the whole.
When there are several projects and the IT department barely keeps up with running the systems, nobody is left to watch the whole picture day to day. As a standing coordinator on the client’s side, I maintain the registers, collect statuses, remind people of deadlines and escalate when something stalls.
What you get.
- A monthly meeting with the office’s secretary or the company’s CEO, and the IT manager, a monthly operations-and-risk report.
- A quarterly review of risks and critical contracts, an opinion before any major purchase.
- The first 90 days: an initial assessment and any urgent “red flags”, setting up the registers and a contract review, a report for the board with a 12–24-month roadmap.
KSC and NIS 2 from the board’s side.
The amendment to the Polish National Cybersecurity System Act (KSC) has been in force since 3 April 2026. The obligations rest with management, not with the IT department alone: the board is responsible for implementation, must complete training and from 2028 may face penalties. Specialists and vendors do the technical work. But someone has to lead it, and many authorities and companies have no head of IT with time for it. I take on that part as a fractional CIO: I am not a security specialist; I make sure the implementation is complete, documented and on time.
I establish whether, and as what kind of entity, the organisation falls under the Act, and set the scope, the people responsible and the schedule. I keep the documentation: the register of systems and vendors, the risk register, procedures, including the incident reporting path within 24 and 72 hours, and the evidence for the auditor. I keep track of deadlines, of the tasks of your own IT and of vendors, and of the clauses in contracts. I ask vendors, IT and the auditor the questions the board should ask, and check that the answers hold up. Every month the board receives one page: status, risks and decisions to be taken.
What I don’t do.
Penetration testing, security monitoring (SOC), system configuration or the audit itself. Specialised firms do this work; I help choose them, define the assignment and hold them to account.
Nearest deadlines. By 3 April 2027, an information security management system and incident handling in place; from 3 April 2028, the first audit of essential entities and possible penalties.
How I work at this stage.
- The first 90 daysAn initial assessment and any urgent “red flags”, setting up the registers and a contract review, a report for the board with a 12–24-month roadmap.
- Steady rhythmStatuses and meetings, registers, a monthly report for the board. We set the rhythm according to the number of projects and how much time your IT team has.
- Working principleEvery action has an owner on your side. I don’t take over delivery and I don’t decide for you.
When there are several projects and the IT department barely keeps up with running the systems, nobody is left to watch the whole picture day to day. As a standing coordinator on the client’s side, I maintain the registers of projects, actions, risks, decisions and documents, collect statuses, remind people of deadlines and escalate when something stalls. I don’t take over delivery and I don’t decide for you: every action has an owner on your side.
- One up-to-date list of projects, actions, risks, decisions and documents, each with an owner, a deadline and a status.
- Weekly statuses and a status meeting with a note and a list of actions, and a monthly report for the secretary, the CEO or the board.
- Reminders, checks that documentation is complete, early warning of risks and preparation of escalations.
- Coordinating information with vendors: statuses, commitments and deadlines.
We set the rhythm according to the number of projects and how much time your IT team has:
- Basic, once a month: updating the registers, up to two status meetings and a monthly report.
- Regular, every week: statuses, a status meeting, registers, follow-up and a monthly report for the board.
- Intensive, once or twice a week: a larger portfolio of projects, the dependencies between them and recovery plans for projects at risk.
- Interim, several times a week: for a few months, when the organisation has a gap in project management and the portfolio needs sorting out quickly. After that you return to a lighter rhythm.
My expertise at this stage.
I advise boards from the perspective of someone who knows both IT and the business, and I gather knowledge so that every project serves the business goals that have been set.
Digital transformation and change management.
This is the key competence that ties all the stages together: over 20 years of work in many organisations, on the client’s side.
Frequently asked questions about this stage.
Do you take over our IT department?
No. I don’t take over the IT department or its budget. I translate the board’s intent into requirements, review IT’s recommendations, and represent the client’s interests in dealings with vendors.
How often do we meet?
We set the rhythm according to the number of projects and how much time your IT team has: from basic (once a month), through regular (every week) and intensive, to interim for a few months.
Are you a cybersecurity specialist?
No, and I don’t pretend to be. In KSC my role is to lead the implementation on the board’s side: documentation, deadlines, vendors, reporting. Specialised firms do the technical work and the audit; I make sure they get a clear brief and that the board knows what follows from it.
Let’s talk about this stage.
The first conversation takes 30 minutes and costs nothing. I reply within 2 working days.