A clear answer on what applies
Which laws and standards apply to you, at what level, and what is really mandatory. Often settled in the first call.
Compliance
Cybersecurity compliance consulting for SMBs: know what applies, then meet it.
Customers, insurers and new EU laws all ask for proof that your security holds up. We tell you which rules apply to you, then lead the work up to the audit.
Is this for you?
Why companies call us about compliance.
- A customer or a tender asks for ISO 27001And you need a realistic path to certification at your size.
- NIS2 or DORA may apply to youDirectly, or through a customer that has to check its suppliers.
- You take card paymentsAnd your bank or payment provider asks for PCI DSS evidence.
- You handle a lot of personal dataAnd you are not sure your GDPR basics, or a DPO duty, are covered.
What is at stake
The cost of getting it wrong is rarely the fine.
It is the contract that quietly goes elsewhere after a security questionnaire you could not answer, or the insurer who renews on worse terms. Most small companies never find out what they lost.
The fix is a clear answer on what applies, a short plan and evidence you can show. Each measure is built once, even when several rules ask for it.
What you get
From first question to audit day.
A plan with costs
Your gaps against each rule, ranked by risk, with a costed action plan and a realistic timeline.
Policies people can follow
We write or update your policies and procedures in plain language, and check that they are applied.
Ready for audit day
We lead the internal audit, prepare the evidence and deal with your certification body or regulator.
A status that holds
Regular reviews and updates as the rules change, so your certificate or compliance status stays current.
Who does what
We lead compliance. Your IT provider makes the technical changes.
What we lead
- Work out which rules apply, and how
- Rank the gaps and set the plan
- Write the policies and procedures
- Oversee the rollout of the technical measures
- Lead the internal audit and the audit preparation
What stays with your IT provider
- Configure systems, access rights and backups
- Deploy the technical measures in the plan
- Keep your systems running day to day
One set of measures, mapped to every rule that asks for it: ISO 27001, NIS2 and GDPR overlap a lot.
How it works
Four steps, planned around your audit date.
- 01
Where you stand
Weeks 1–3
We compare what you have with what each rule requires. You get the gaps, ranked, with a costed plan and a realistic timeline.
- 02
Close the gaps
From week 3
We write the policies and procedures and oversee the technical changes your IT team or provider makes.
- 03
Get ready for the audit
Before the audit
We lead the internal audit, prepare the documents and deal with your certification body or regulator.
- 04
Keep it current
Ongoing
Regular reviews and updates as the rules change.
How it starts
A fixed fee for the project, never hourly.
You pay a fixed fee for the work up to compliance or certification, invoiced as each step is completed. Keeping it current afterwards is an optional monthly fee. Each law and standard has its own page with what to expect.
- Price
- Fixed fee
- Duration
- ISO 27001: typically 6–12 months
Fixed quote after the free call.
book a free 25-minute consultationFor your IT manager, DPO or CFO
The 12 laws and standards we cover.
LAW THAT MAY APPLY
NIS2
Cybersecurity of mid-sized and larger companies in 18 sectors, and of their suppliers through contracts.
Read more
LAW THAT MAY APPLY
DORA
IT resilience of banks, insurers and other financial entities, and of the IT suppliers they rely on.
Read more
LAW THAT MAY APPLY
EU GDPR
Personal data protection: breach response, impact assessments and coordination with your DPO.
Read more
LAW THAT MAY APPLY
EU AI Act
Rules for using and building AI, delivered through our AI governance service.
Read more
LAW THAT MAY APPLY
Cyber Resilience Act
Cybersecurity inside CE marking for products with software or a connection.
Read more
CERTIFICATION
ISO 27001
The security certification customers ask for. Led by a PECB-certified ISO 27001 Lead Auditor.
Read more
CERTIFICATION
ISO 42001
A certifiable management system for AI. It supports AI Act compliance but does not replace it.
Read more
CERTIFICATION
ISO 27701
Certifiable privacy management. Since the 2025 edition it stands on its own; ISO 27001 is no longer a prerequisite.
Read more
CERTIFICATION
PCI DSS
Card-payment security: scope, self-assessment guidance and oversight of the fixes, against PCI DSS v4.0.1.
Read more
SPECIFIC NEED
DPO as a Service
An outsourced data protection officer under GDPR Article 37, for organisations in France and its overseas regions.
Read more
SPECIFIC NEED
Data Governance Act
For organisations re-using public-sector data, intermediating data sharing or acting as data altruism organisations.
Read more
SPECIFIC NEED
EU Cybersecurity Act
The EU certification framework for ICT products, services and processes. Can be required in some public tenders.
Read more
FAQ
What owners and IT managers ask us about compliance.
How do I know which regulations apply to my business?
It depends on your sector, size, and the data and payments that flow through your business. NIS2 generally covers companies with 50+ staff, or turnover and balance sheet both above €10M, in 18 sectors. DORA covers EU financial entities and reaches their ICT providers. GDPR covers almost anyone handling EU personal data. PCI DSS applies if you take card payments. The free call usually settles it.
How long does compliance take?
It depends on the rule and your starting point. From a low baseline, ISO 27001 certification typically takes 6–12 months, and NIS2 3–6 months to reach a defensible position. DORA depends heavily on your ICT supplier contracts. You get a realistic timeline at the end of the gap analysis.
What's the difference between a gap analysis and an audit?
A gap analysis looks forward: where you are against the rule, and the shortest path to close the gap. An audit looks back: whether the measures you already have actually work. Use the first when you start, the second when you check.
Can you handle several frameworks at once?
Yes, and most engagements do. ISO 27001 and NIS2 overlap a lot, ISO 27701 follows the same management-system structure, and GDPR measures support much of NIS2 governance. We map the overlap during the gap analysis, so each measure is built once.
Does my business need a DPO?
Under GDPR Article 37 you must appoint a data protection officer if you are a public authority, or if your core activities involve large-scale systematic monitoring of people or large-scale processing of special-category data. Our DPO as a Service covers organisations in France and its overseas regions.
What happens after the certificate is issued?
A certificate is a snapshot. Surveillance audits, regulatory reporting and changing rules follow. Our optional monthly upkeep covers regular reviews, a watch on the rules, evidence maintenance and management briefings.
How is the engagement priced?
A fixed fee for the project (gap analysis, closing the gaps, audit preparation), invoiced as each step is completed, then an optional monthly fee to keep it current. The figures are in the proposal after the free call. No hourly billing.