Audit and gap analysis
We review your controls against the framework you need, ISO 27001, ENS, NIS2, DORA or several at once, and hand you a prioritised plan with realistic costs and timelines.
- Interviews and evidence
- Gap map
- Action plan
- Board summary
- to a complete diagnosis
- 3 wks
- to a complete diagnosis
- frameworks covered
- 12
- frameworks covered
- unified when several frameworks apply
- 1 plan
- unified when several frameworks apply
In detail
From “we don’t know where to start” to certified.
Most companies come to us for a concrete reason: a customer asks for ISO 27001, a tender requires ENS, or leadership wants to know if NIS2 applies. We start with a gap analysis that tells you exactly where you stand and what is missing.
Then we don’t hand you a folder of templates. We write policies with your team, implement technical controls, train owners and prepare the evidence the auditor will ask for. We use GRC tooling so everything stays alive, not in a Word file nobody opens.
We support you through the certification audit and afterwards with maintenance: annual internal audits, management reviews and non-conformity follow-up.
Real scenarios
Situations we solve every month.
Tender with a deadline
A services company needed ENS medium category in three months to bid for a contract. We got there with two weeks to spare.
Enterprise customer demands ISO
A SaaS company was losing deals without ISO 27001. We implemented the ISMS alongside its product roadmap, without stopping development.
Several standards, one effort
A financial group needed DORA, NIS2 and ISO 27001. We unified controls so one piece of evidence serves all three.
What you get
Everything the auditor asks for.
- Gap analysis report with a roadmap
- Risk assessment and statement of applicability
- Policies and procedures tailored to your company
- Implementation of technical and organisational controls
- Internal audit before certification
- Support during the external audit
How we engage
From a diagnosis to a virtual CISO.
Diagnosis
Know where you are and what is missing.
- 2 weeks
- Gap report
- Fixed implementation quote
- Most chosen
Certification
We take you all the way to the certificate.
- 3 to 6 months
- Full implementation
- Audit support
CISO as a service
A security lead without the hire.
- Days per month
- Certification maintenance
- Board reporting
Governance and risk
What is included
- 01
Interviews and evidence
We talk to your teams and review real policies, logs and configurations.
- 02
Gap map
Every control rated by maturity and associated risk.
- 03
Action plan
Prioritised tasks, owners, estimated budget and schedule.
- 04
Board summary
One page leadership understands and can sign off.
Audit and gap analysis
How we work
- 1
Kick-off
We set scope, frameworks and contacts.
- 2
Review
Interviews, evidence and targeted technical checks.
- 3
Analysis
We compare against the framework and size the effort.
- 4
Delivery
Leadership presentation and roadmap.
FAQ
Frequently asked questions
Do you also implement the gaps?
Yes, but it is optional. Use the plan with your own team or with us.
What if I need several frameworks?
We map shared controls so you never do the work twice.
Do you issue the certificate?
No. For independence, certification is issued by an accredited body. We prepare you and support you through the process.
How much of my team’s time do you need?
It depends on size, but a few hours a week from the owner plus occasional workshops with each area is usually enough.
Can I certify several standards at once?
Yes, and it is the most efficient route. ISO 27001, ENS, NIS2 and DORA share most of their controls.
You may also need
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.