Gap analysis
We compare the current state with the requirements of the regulation or standard: documents, controls, processes. You get a prioritised list and a realistic plan.
Compliance
NIS2, DORA and ISO 27001 require not a folder of documents but a working system: risk management, security controls, incident procedures and evidence. We help you build it, maintain it and show it to an auditor, with ISACA and PECB certified specialists.
Built for ISO 27001NIS2 DORA
- NIS2 directive
- DORA
- CISO as a Service (vCISO)
Compliance that works between audits too
- NIS2 · DORA implementation from risk to reporting procedures
- ISO 27001 ISMS implementation through to the certification audit
- vCISO a security leader without a full-time hire
- ISACA + PECB certified auditors and implementers
Compliance projects often end with a folder of documents unrelated to how the company actually works. An auditor notices this within the first hour, and a regulator notices it after an incident. NIS2, DORA and ISO 27001 ask for the same thing: know your risks, have controls to manage them, respond to incidents by procedure, and prove all of it.
Our advantage is that we are both the IT provider and the compliance consultant. The documents we write rest on what we ourselves manage: EDR, MFA, backup, vulnerability scanning, SOC monitoring. So the policy says what the systems do, and audit evidence is generated from day-to-day management instead of being written before the audit. Projects are led by specialists certified as CISA, CISM, CRISC and ISO/IEC 27001 Lead Implementer.
Services
NIS2 directive
Who it applies to, what you need in documents and systems, how to report incidents: implementation from A to Z.
Learn more 
DORA
For financial institutions and their IT providers: ICT risk management, incidents, resilience testing, third-party risk.
Learn more 
CISO as a Service (vCISO)
A security leader without a full-time hire: policies, risk register, incident plan, board reporting, audit coordination.
Learn more 
IT security audit
Technical and process assessment with risk ratings and an action plan, by CISA certified auditors.
Learn more 
Risk assessment
Risk register, assessment methodology and management plan under ISO 27005 and NIS2 / DORA requirements.
Learn more 
Security policies and procedures
A document set that matches how the company works: access, backup, incidents, suppliers, employees.
Learn more 
Compliance consulting
For when you need to answer customer security questionnaires, prepare for a tender, or assess whether a regulation applies to you.
Learn more NIS2, DORA and ISO 27001: what applies to whom
Three different requirements, one security system.
| NIS2 | DORA | ISO 27001 | |
|---|---|---|---|
What it is | an EU directive, transposed into national cybersecurity law | an EU regulation for the financial sector, applicable since January 17, 2025 | an international information security management standard |
Who it is mandatory for | essential and important entities: energy, transport, health, digital infrastructure and more | banks, credit unions, insurers, payment institutions and their ICT providers | no one by law; required by customers, tenders and partners |
What it requires | risk management, security measures, incident reporting, supply chain control | ICT risk management, incidents, resilience tests, a register of third parties | an ISMS: policies, risks, controls, internal audits, continual improvement |
Incident reporting | initial notice within 24 hours, report within 72 hours | to the supervisory authority within the regulation's deadlines | internal procedure under the ISMS |
Evidence | documents and reports for the national cybersecurity authority | register, reports, test protocols | certification audit every 3 years, surveillance audits every year |
How we help | audit, risks, policies, controls, vCISO | ICT risk register, PlanB, exercises, supplier register | ISMS implementation through to certification (Lead Implementer) |
How a compliance project runs
From gap analysis to audit, usually within 3-6 months, depending on scope.
Risks and policies
We build the risk register and prepare policies and procedures aligned with how the company works and which systems we manage.
Controls
We implement the missing controls: MFA, EDR, backup, vulnerability management, SOC monitoring, PlanB, so that the documents say what the systems do.
Evidence and audit
We collect evidence, run incident and recovery exercises, accompany you through the audit and keep maintaining the system, with a vCISO service if needed.
Frequently asked questions about compliance
Does NIS2 apply to us?
It depends on your sector and size. In the first consultation we assess whether you are an essential or important entity, or whether the requirements reach you through customers as a supplier.
How long does ISO 27001 take?
For a small or mid-sized company, usually 4-8 months to the certification audit, depending on the starting point. Part of that time goes not to documents but to implementing controls and changing habits.
Can you both audit and implement?
To preserve independence, the certification audit is carried out by an external body. We do internal audits, gap analysis and implementation, with different people in different roles.
What if we have no IT department of our own?
Then we are both your IT provider and your compliance partner: we implement and manage the controls ourselves, so audit evidence is generated from day-to-day management.
Expertise confirmed by certifications
This service is delivered by specialists with valid international certifications. Their expertise is confirmed by independent organisations, not by us.
-
Certified Information Systems Auditor
Audit and evidence in line with international information systems audit standards.
-
Certified Information Security Manager
Security governance, policies and incident processes following the ISACA methodology.
-
Certified in Risk and Information Systems Control
Risks are assessed and controlled using the international IT risk methodology.
-
ISO/IEC 27001 Lead Implementer
The service is delivered in line with the requirements of an ISO/IEC 27001 management system.
Get a compliance quote
Tell us which regulation or standard is relevant to you. Within 1 business day we will propose a plan and an estimate.
We reply within 1 business day