Outsourced CISO · NIS 2 · DORA · ISO 27001
External CISO: your cybersecurity, managed for you.
Looking for an external CISO? Luxgap provides an outsourced CISO to run your cybersecurity, your NIS 2 / DORA / ISO 27001 compliance and your 24h incident management. An integrated team of cyber engineers + lawyers, with a regular on-site presence in Luxembourg / France / Belgium / Germany / the Netherlands / Switzerland.
What is an external CISO?
An external CISO (outsourced Chief Information Security Officer, known in French as an RSSI externalisé) is a cybersecurity lead officially appointed by your management, but who is not your employee. They carry the operational responsibility for cyber governance: security policy, risk management, oversight of technical controls, reporting to the authorities (ILR for NIS 2, CSSF for DORA, BFA in France, etc.), incident management.
It is the recommended model for organisations of 50 to 500 staff that do not need a full-time CISO, or that want senior expertise without taking on a complex hire. The NIS 2 directive (transposed by the law of 5 May 2026) and the DORA regulation (applicable since 17 January 2025) require real cyber governance from the entities concerned in Luxembourg: having a designated CISO (internal or external) is becoming a concrete requirement.
It is the recommended model for organisations of 50 to 500 staff that do not need a full-time CISO, or that want senior expertise without taking on a complex hire. The NIS 2 directive (transposed by the law of 5 May 2026) and the DORA regulation (applicable since 17 January 2025) require real cyber governance from the entities concerned in Luxembourg: having a designated CISO (internal or external) is becoming a concrete requirement.
Why outsource the CISO role?
Three economic reasons + one operational.
Cost: a senior in-house CISO costs 110 to 180 k EUR fully loaded. An external Luxgap CISO costs 4 to 12 k EUR / month depending on scope, i.e. 50 to 70% savings, without the resignation risk.
A complete team: an in-house CISO faces everything alone (governance + technical + incidents + audits). An external Luxgap CISO is a team: cyber engineers, GDPR/NIS 2/DORA lawyers, developers, pentesters. You get all that expertise for the price of a part-time role.
Continuity: no single-person resignation risk. No 6-month vacancy. No loss of knowledge.
Independence from IT vendors: we resell neither Microsoft, nor Cisco, nor Palo Alto. Our recommendations are not biased by a commercial partnership.
Request an external CISO quote →
Cost: a senior in-house CISO costs 110 to 180 k EUR fully loaded. An external Luxgap CISO costs 4 to 12 k EUR / month depending on scope, i.e. 50 to 70% savings, without the resignation risk.
A complete team: an in-house CISO faces everything alone (governance + technical + incidents + audits). An external Luxgap CISO is a team: cyber engineers, GDPR/NIS 2/DORA lawyers, developers, pentesters. You get all that expertise for the price of a part-time role.
Continuity: no single-person resignation risk. No 6-month vacancy. No loss of knowledge.
Independence from IT vendors: we resell neither Microsoft, nor Cisco, nor Palo Alto. Our recommendations are not biased by a commercial partnership.
Request an external CISO quote →
What does a Luxgap external CISO actually do?
Security policy aligned with ISO 27001 / NIS 2 / DORA / GDPR. Cyber risk mapping and criticality matrix. Risk treatment plan (technical + organisational). Incident reporting to the authorities: ILR within 24h for NIS 2, CSSF for DORA, CNPD for GDPR breaches. Supply chain audit: assessment of critical ICT providers (DORA pillar 5). Monthly security committee governance with the executive committee. Awareness for the executive committee + IT teams + users. Continuous regulatory watch (CSSF circulars 22/806, 24/847, ENISA, ANSSI, BSI). Test management: application pentests, M365 / Google Workspace audits, TLPT for large financial entities.
What are the 3 tiers of the external CISO mandate?
Essential (SMEs, 50-150 staff): 1 day / month on site + on-call incident support, governance, policy, annual audit. 4 to 6 k EUR / month.
Standard (150-500 staff): 2-3 days / month, quarterly executive committee, on-call incident handling, half-yearly audit, roadmap management. 7 to 12 k EUR / month.
Premium (500+ staff or sensitive sector: banks, insurers, PSF, health): 5+ days / month, dedicated team, direct integration into the executive committee, continuous audit, supply chain, TLPT. 15 to 30 k EUR / month.
Minimum 12-month commitment (supervisory authorities take a dim view of frequent CISO changes), then terminable with 3 months' notice. No hidden set-up fees, no software licence to buy, no TBD in our quotes.
Standard (150-500 staff): 2-3 days / month, quarterly executive committee, on-call incident handling, half-yearly audit, roadmap management. 7 to 12 k EUR / month.
Premium (500+ staff or sensitive sector: banks, insurers, PSF, health): 5+ days / month, dedicated team, direct integration into the executive committee, continuous audit, supply chain, TLPT. 15 to 30 k EUR / month.
Minimum 12-month commitment (supervisory authorities take a dim view of frequent CISO changes), then terminable with 3 months' notice. No hidden set-up fees, no software licence to buy, no TBD in our quotes.
Which sectors and countries does Luxgap serve as external CISO?
Luxgap is a Luxembourg firm, but our external CISO mandates apply throughout the European Union. We work in Luxembourg (CSSF, ILR, BCL), France (ANSSI, ACPR, AMF), Belgium (CCB, FSMA, NBB), Germany (BSI, BaFin), the Netherlands (NCSC-NL, AFM, DNB), and more broadly across the EEA.
Sectors: banks, PSF, investment funds, insurers, e-commerce, industry, health, municipalities, critical ICT providers (DORA), NIS 2 essential entities (energy, transport, water, digital infrastructure). French-speaking team (FR / EN / DE).
Sectors: banks, PSF, investment funds, insurers, e-commerce, industry, health, municipalities, critical ICT providers (DORA), NIS 2 essential entities (energy, transport, water, digital infrastructure). French-speaking team (FR / EN / DE).
Let's talk about your situation.
Quote within 24 business hours. No commitment, no sales pressure.