Moaad El Farouki

Risk analysis and monitoring: Assessment of IT risks for projects, and consulting on security, resilience, and project-related risks, as well as risk remediation measures.

Assistance in conducting security audits and vulnerability management.

Expert advice in identifying security solutions and validating IT solutions, particularly in projects involving AI and Blockchain. Contribute to departmental risk governance and risk monitoring for all projects, including the production of regular risk reports.

Audit and support for the implementation of ISMS according to ISO/IEC 27001/02 and information security risk management (ISO/IEC 27005, EBIOS).

Assistance in complying with national laws and directives related to IS security (05-20, 09-08, DNSSI) and cybersecurity frameworks (GDPR, NIST, CIS Controls, etc.).

Support for CISOs, development of information security policies and procedures, and data and asset classification.

Business continuity support: ISMS implementations (ISO 22301), BIA and risk analysis, business continuity strategies and plans, IT recovery plans, etc.

Information system security assessment, writing diagnostic reports and recommending action plans to address deficiencies.

Clients:

Assessment of IT risks and conducting audit missions (CAC, ISAE 3402) according to applicable regulations and standards (SOX/PCAOB, ISA). Audit of the design and operational effectiveness of IT general controls (ITGC) on the application and infrastructure layers of financial systems. Evaluate weaknesses within existing mechanisms (Organization and governance, Policies and procedures, Operational security, Access management, Change management, ...). Assurance on third-party services: Evaluation of the service provider's internal IT controls to provide reasonable assurance to clients on risks impacting their financial data (ISAE 3402).