Onet, a French family-owned group founded in 1860, is a global leader in engineering and services. Across its various operations, the group employs 80,000 people. With a decentralized structure consisting of autonomous subsidiaries, this leader in multiservice solutions faces growing complexity in the area of cybersecurity.
Since joining the company in 2022, Hervé Comes (CISO) has been tasked with driving the group’s cybersecurity strategy and supporting business units in their digital transformation, working with a central team and a network of representatives in France and abroad. Working alongside him, Marion Borne (PMO) coordinates and oversees day-to-day operations. Together, they face three major challenges.
A single platform for managing regulatory certifications (ISO 27001, NIS 2, GDPR, ISO 901) and ensuring the level of compliance required by clients (Air Cyber, AI Act).
A unified interface for managing risks, compliance, and improvement plans, as well as automating assessment campaigns.
Close collaboration to develop the GRC strategy even before technical deployment.
Faced with a major audit scheduled within six months, the cybersecurity team decided to rise to the challenge by leveraging Tenacy to centralize an ISMS that had previously been fragmented. In just three weeks, a detailed assessment of the group’s maturity level was delivered. The platform also helped demonstrate Onet’s commitment to continuous improvement, which was praised by the auditor.
To demonstrate to the auditor that the subject matter was well understood, that cybersecurity was well-structured, and that the organization was committed to a process of continuous improvement, thereby ensuring the successful attainment of certification.
“Without Tenacy, we would have faced three major non-conformities. The tool was instrumental in demonstrating to the auditor that our approach was structured and sustainable, even within a short timeframe.”
– Hervé Comes, Group CISO at Onet
{{cta-lead-magnet}}
Manually tracking more than 600 suppliers and autonomous subsidiaries created constant operational noise.
With Tenacy, the PSSI Group was able to translate its security policy into concrete actions through automated assessment campaigns. As a result, the CISO no longer has to collect evidence via Excel; instead, they have real-time analytical visibility.
Move away fromExcel and a multitude of disparate tools and files in order to unify the group’s cybersecurity governance.
The implementation of the solution led to the creation of a dedicated GRC unit. By integrating the tools used by the CISO and the DPO into a single interface accessible to business stakeholders, cybersecurity has become a collective effort. Every action is tracked and recognized, facilitating the adoption of cybersecurity practices at all levels of the organization.
“We’ve built a true cyber community, with dedicated and recognized business representatives.”
– Hervé Comes, Group CISO at Onet
Break downthe silos between support functions and business units to enable cross-functional governance.
Tenacy enables Onet to precisely meet growing customer demands, turning compliance into a key selling point. Through customized dashboards, the company also aims to quantify the financial impact of cybersecurity (risks avoided, contracts won, etc.).
“Cybersecurity has become a major focus in the business world because it adds value. I can’t imagine CISO’s reporting to senior management on strategic issues without a platform like Tenacy.”
– Hervé Comes, Group CISO at Onet
Promotecybersecurity as a competitive advantage and a direct driver of innovation within the group.
Developing a cybersecurity roadmap is one thing. Maintaining it over the long term, defending it before the Executive Committee, and proving that it actually reduces risk is another. This article provides a practical method for structuring your roadmap, managing it based on all its metrics, and presenting the right figures to the right audiences.
In this article, we take a look at the five major points of friction that undermine the relationship between the CIO and the CISO. And, most importantly, we offer concrete steps to finally overcome them!