Accredit
Prepare or recover a security accreditation without separating the package from operations.
GRC · security accreditation · DevSecOps · resilience
Connect security governance to operations.
We help your teams understand risk, choose the right response, implement it and sustain it through security accreditation.
Starting points
A clear path, not one more tool.
We step in when obligations, risks and technical reality need to move forward together.
Prioritize
Turn risks, gaps or obligations into ordered decisions and actions.
Secure
Evolve a platform or DevSecOps chain without losing operability.
Recover
Organize remediation, continuity or recovery after a major incident.
End-to-end support
Decide. Secure. Hand over.
Each stage prepares the next. Governance does not remain in a document, and technology is not deployed without a decision.
- 01
Understand
Context, obligations, critical assets, stakeholders and the expected decision.
- 02
Set direction
Risks, scenarios, priorities, target state and a shared treatment trajectory.
- 03
Implement
Organizational measures, architecture, automation and technical controls.
- 04
Steer
Remediation, MCO/MCS, indicators, continuity and long-term trade-offs.
- 05
Accredit and hand over
Residual risk, decision package, responsibilities and team ownership.
Complementary expertise
Three areas of expertise, one trajectory
We bring the right level of governance and engineering to your context instead of imposing a standard model.
01
Governance, risk and security accreditation
Clarify obligations, analyze risk, structure governance and prepare a defensible accreditation decision.
- EBIOS RM and ISO 27005
- NIS2, DORA and CRA
- accreditation package and trajectory
02
Secure platforms and DevSecOps
Industrialize cloud foundations, delivery and controls so changes remain reproducible and operable.
- Kubernetes, KaaS and IaC
- CI/CD, GitOps and software supply chain
- SBOM, CVEs and MCO/MCS
03
Remediation and operational resilience
Prioritize gaps, organize continuity and support recovery without disconnecting security from operations.
- remediation backlog
- BCP/DRP and crisis management
- indicators and team handover
Field markers
Contexts where decisions must remain applicable
These markers come from Adrien’s professional experience. They indicate the level of complexity addressed and are not a Murillo Consulting client portfolio.
Critical platform
100+ VMsOperational security, vulnerabilities, MCO/MCS and accreditation.
Private cloud
KaaS and DevSecOps chainKubernetes, IaC, GitOps, SBOM and remediation integrated into delivery.
CyberRange
60 usersEight scenarios and ten industrialized environments.
Multi-site IS
Six sitesContinuity, operations and security for a system of more than 50 servers.
Professional recommendations
Adrien’s work, seen by the people who worked with him.
These English texts translate French summaries of professional recommendations received across past engagements. They describe a way of working and do not constitute endorsements by the organizations mentioned.
Interactive simulation · 12 decisions
Defend the Sentinel pipeline.
Inspect every signal, decide under pressure and preserve the integrity of a DevSecOps chain. Cases become deliberately more ambiguous as the mission progresses.
Mission progress 0%
Operational context
Signal waiting
Launch the mission whenever you are ready.
Launch the mission whenever you are ready.
Control analysis
Keyboard: A to allow, B to block and P to pause. The controls also work by touch.
A useful first step
Let’s clarify what needs to move first.
A short conversation is enough to review the context and identify the appropriate next step.