// CYBERSECURITY / COMPLIANCE & GRC
NIS2 is enforced. DORA is binding. Most clients are not ready.
The fines reach into the millions, directors can be held personally liable, and most organisations in scope have not finished a basic gap assessment. We deliver the assessment and remediation and stand up the monitoring and evidence, handed over for your team to run, under your brand.
Start a compliance conversationThe regulations are live. The clients are not ready.
NIS2 moved into active national enforcement, and member states including Germany, the Netherlands, Italy and Austria have opened formal audit cycles. DORA has been binding on financial entities since the start of 2025. Yet most organisations in scope have not completed even a basic gap assessment. The consequences are concrete: essential entities face fines into the millions, management can be held personally liable, and well over a hundred thousand entities across the EU fall in scope. For a channel partner, that is both the problem and the opening: clients are asking about compliance, and most do not have the answer.
What we deliver.
Gap Assessment
Structured assessment against NIS2, DORA, ISO 27001, NIST CSF 2.0 and CIS Controls v8, producing a prioritised remediation roadmap rather than a generic checklist nobody acts on.
Control Implementation
Hands-on build of incident response playbooks, access control frameworks and business continuity procedures, mapped to the 24, 72 and 30-hour NIS2 and DORA reporting deadlines so the obligations are wired into the runbook.
Continuous Monitoring
Always-on evidence collection through Microsoft Sentinel, Purview Compliance Manager, Azure Policy, AWS Security Hub and FortiSIEM, replacing the point-in-time snapshot that is already stale the day after the audit.
ISO 27001 Certification
The full ISO 27001:2022 journey: ISMS design, documentation, internal audit preparation and stage 1 and stage 2 readiness, increasingly the framework NIS2 expects organisations to demonstrate.
Board-Level Reporting
Executive dashboards and management accountability documentation that answer the NIS2 and DORA requirement for the board to approve and oversee cyber risk, with directors personally on the hook.
Unified Control Library
One control set mapped to NIS2, DORA and ISO 27001 at once, so the same piece of evidence satisfies three frameworks instead of being rebuilt three times.
The stakes on the table.
How the options compare.
What your client gets from a Big-Four advisory, a boutique GRC consultancy, or our team under your brand.
Compliance and GRC, answered straight.
01 We already run some ISO 27001 questionnaires. Is this different?
NIS2 and DORA add obligations ISO 27001 alone does not cover: mandatory reporting timelines of 24, 72 and 30 hours, personal management liability, supply chain security duties and continuous evidence for audit. We address that regulatory layer while giving you the ISO 27001 foundation underneath where it is needed.
02 Our clients are not sure they are in scope for NIS2. How do we find out?
Classification is the first deliverable. We map the client against the NIS2 sector thresholds, headcount, turnover and covered sector, and DORA applicability, so there is no ambiguity before anyone spends a euro on remediation.
03 Can the work be phased to manage cost?
Yes. The gap assessment is a scoped, fixed-price engagement. Remediation is then prioritised by risk and business impact, so the client controls the spend curve. We deliver the gap assessment and remediation as scoped projects and stand up the monitoring tooling, then hand it over for your team or the client to run ongoing.
04 What tools do you use for automated monitoring?
Microsoft Sentinel with its NIS2 and DORA compliance workbooks, Microsoft Purview Compliance Manager, Azure Policy, AWS Security Hub and FortiSIEM. These are tools the client is often already licensed for, so evidence collection is automated from day one rather than dependent on manual log reviews.
05 How does personal management liability actually work under NIS2?
NIS2 requires the management body to approve and oversee cyber risk measures, and directors can be held personally liable for failures. The board-level dashboards and accountability documentation give management the evidence they need to show that oversight is real and ongoing.
06 Whose name is on the deliverables?
Yours. Every report, dashboard, gap register and board briefing carries your branding. We do not appear on the output. That is the operating model, not an option.
Tell us what your clients need.
A tri-cloud migration. A 200-site SD-WAN rollout. A security architecture before NIS2 hits. An AI system your client is asking about next quarter. We scope it, staff it, and deliver it under your brand. One conversation tells us if we are the right team.