Mumin Guvendi MG CYBER
GRC cybersecurity consultant · Independent

Making cyber compliance concrete and measurable.

I help CISOs and leadership teams run their ISO 27001 ISMS, their risks and their vulnerabilities, from the board room to the technical teams.

Contact me See my services
Services

Four ways to move your security forward

01/04

ISO 27001 ISMS and risk assessment

Certification, maintenance, ISO 27005, EBIOS RM, NIS2 and DORA.

Learn more →
Your need
Get or keep ISO 27001 certification, or meet NIS2 and DORA requirements.
What I do
Gap assessment against ISO 27001:2022, ISO 27005 or EBIOS RM risk assessment, policies and procedures, preparation for internal and certification audits.
What you get
A usable risk assessment, a Statement of Applicability, a risk treatment plan and an audit-ready ISMS.
02/04

CISO support

Hands-on support or part-time CISO: governance, IAM, third-party risk.

Learn more →
Your need
An overstretched CISO, or no full-time CISO at all.
What I do
Hands-on support or part-time CISO: governance, access and privileged access reviews (IAM, PAM), third-party risk (TPRM), awareness and crisis exercises.
What you get
A security roadmap that is actually followed, documented decisions and security built into projects.
03/04

Security steering and coordination

Committees, KPIs, dashboards and executive reporting, in French or English.

Learn more →
Your need
Make security readable for leadership and get several teams moving.
What I do
Security committees, KPIs and Power BI dashboards, reporting to CISOs and executive committees, in French or English.
What you get
Regular committees, tracked action plans and auditable minutes.
04/04

Vulnerability management

Risk-based prioritisation, remediation, exceptions and IT compliance.

Learn more →
Your need
Thousands of findings from scanners, and few actual fixes.
What I do
Risk-based analysis and prioritisation, remediation tickets, patching follow-up, exception management, end-of-support systems tracking.
What you get
A smaller, prioritised backlog, justified exceptions and clear compliance reporting.
8 years
in cybersecurity, 10 in IT
4
ISO, EBIOS RM and CEH certifications
6
regulated or demanding sectors
3
countries
Where I have worked

Environments where mistakes are expensive

I work where governance meets technical teams, in French and in English.

  • BNP ParibasBanking
  • FDJRegulated gaming
  • OrangeTelecoms, defence-sensitive context
  • NexansManufacturing
  • SyscoFood distribution
  • MonoprixRetail
Briefings

The cyber news that matters to a CISO

All briefings →
Threats and vulnerabilities

PHP: two critical flaws allow remote code execution

On 21 October, CERT-FR issued an alert about two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution. Proofs of concept have been circulating since 22 October. All 5.x to 8.1.x versions are affected, as are the 8.2 to 8.5 branches before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Branches 5.x to 8.1.x are no longer maintained, so migrating is the only fix.

What it means for you: List your internet-facing PHP servers, patch them first, and treat outdated versions as a risk to decide on, not a permanent exception.

Source: CERT-FR ↗
Regulation

NIS2: France's Resilience bill pulled from the agenda again

On 6 October, the French National Assembly removed the bill transposing NIS2, along with the CER and DORA directives, from its 7 and 9 October sittings. No new date has been set. The Senate passed the text in March 2025 and it has been waiting for a floor debate since September 2025, although the transposition deadline was 17 October 2024. Until the law is passed, NIS2 obligations do not apply under French law.

What it means for you: The delay changes nothing of substance: use the time to confirm whether you are an essential or important entity and measure your gaps, rather than waiting for the final text.

Source: Assemblée nationale ↗
Risk and governance

Cyber threats in Europe: ENISA flags the weakness of dependencies

The ENISA Threat Landscape 2026 report, covering 2025, highlights continued attacks through supply chains and service providers, which often cause high-impact incidents. 73% of targeted organisations are essential or important entities under NIS2. More than 48,000 CVEs were published in 2025, up 22% on 2024, and 60% of intrusions with a known entry point exploited a vulnerability.

What it means for you: Your suppliers are part of your attack surface: assess their cyber maturity and write security requirements into your contracts.

Source: ENISA ↗
Available from November 2026

Let's talk about your project.

Need a certification, support for your CISO or a vulnerability backlog under control? Get in touch.

Contact me LinkedIn