When to call us

Nobody owns securityIT handles it on the side, or it is left to an outside vendor.
A customer or head office sent a security questionnaireYou need to know what to answer and where the gaps are.
Too many options, no orderPlenty of possible measures, no way to decide what fits your size and budget.
Management wants a plan with numbersWhat the investment is and what it reduces.
Head-office policy has to work in JapanGroup standards need adapting to the local environment and Japanese law.
After an incident, the fixes have to stickTurn the remediation list from the report into day-to-day practice.

What we cover

  • Assessment:Microsoft 365 or Google Workspace configuration, network devices, servers, endpoints, backups and log retention. We look at the settings, not at a questionnaire.
  • Prioritisation:Gaps ranked by likelihood, impact and effort to fix.
  • 90-day plan:The measures for the first three months with owners and indicative cost.
  • Implementation support:Shared with your IT staff or vendor. We can make the changes or specify and verify them.
  • Reviews:Quarterly progress and threat review, or an ongoing retainer.
  • Policies and questionnaires:Answers to customer and head-office security questionnaires; an information security policy sized for your company.

We do not sell products. CS2 is not a reseller. Where a tool is needed we compare domestic and international options on cost and operating effort, and tell you which one fits.

How an engagement runs

  1. Assessment (about 2 weeks)Interviews with management and IT, configuration review of the main systems, a vulnerability assessment where useful.
  2. PrioritisationGaps ranked by likelihood, impact and effort; the first 90 days are chosen from the top of the list.
  3. 90-day planMeasures, owners, deadlines and cost on one page, presented to management.
  4. Implementation supportConfiguration changes, vendor coordination, verification. Progress reported weekly or fortnightly.
  5. ReviewQuarterly check of progress and the next 90-day plan.

Deliverables

  • Assessment findings: what was checked and what was found
  • Prioritised measures and the 90-day plan
  • Management summary in English, Japanese or both
  • Implementation progress reports
  • Questionnaire answers and policy drafts where needed

We can stay on as the standing security contact until you hire someone, or alongside them afterwards.

Indicative pricing

Starting pointFrom about JPY 350,000Indicative for the assessment and 90-day plan. The price depends on the number of systems and sites, whether a vulnerability assessment is included and the implementation support you want. Retainers are quoted monthly. Scope and price are fixed before work starts.

Frequently asked questions

What does it cost?

The assessment and 90-day plan start at about JPY 350,000, depending on the number of systems and sites, whether a vulnerability assessment is included and how much implementation support you want. Retainers are quoted monthly.

We have IT staff. Do we still need consulting?

Running operations and at the same time setting security priorities and explaining them to management is a lot for one IT team. CS2 takes the judgement and planning; the hands-on work is shared with your staff or vendor.

Will we have to buy tools?

We start with what you already have, such as the standard features of Microsoft 365 or Google Workspace and your existing devices. Only where something is missing do we compare options and recommend one.

Can you work in both English and Japanese?

Yes. Meetings, reports and management briefings are available in English and Japanese, so a foreign head office and the Japanese team can work from the same findings.

Can you just help with a customer's security questionnaire?

Yes. Drafting the answers and listing the gaps is a service on its own.

What size of company is this for?

Mostly companies of about 20 to 500 staff and Japan subsidiaries of foreign groups. Ask us about other sizes.

Start with a two-week look at where you stand.

Tell us about your company and we will propose the scope of the assessment and how it would run.

Contact