Services
We help with what you have no time for: the BIA workshop, the internal audit, your customers’ questionnaires
Delivered by our team and contracted separately. If you use the platform, what we do stays in the right module and next year starts from there; if not, we hand it over as a report.
- Fixed scope and deliverable
- You approve
- Next time starts where we left off
Which situation are you in?
Each service, in the situation it usually comes up in. Each one shows how often it is done and what stays in place if you use the platform; if you don’t, we deliver it as a report. The price goes in the proposal.
Starting from scratch
3 services
So you don’t start with a blank page: where you stand, your suppliers and your data, already loaded.
- Service · Once
Gap analysis against a framework
We measure where you stand against ISO 27001, the ENS or DORA and what you still need to comply.
Partly stays in Compliance
- Service · When you start
Initial supplier review
We review up to 50 suppliers and classify them by criticality, so you start with the inventory done.
Stays in Third parties
- Service · When you start
Data migration from spreadsheets
We bring into the platform what you keep today in spreadsheets or another tool.
Partly stays in the platform
It comes round every year
8 services
The audit, the BIA, the DORA register and the exercises: what recurs, each time building on the previous one.
- Service · Every year
Risk assessment
The annual risk assessment of your security system, with MAGERIT and PILAR when it is for the ENS.
Delivered as a report
- Service · Every year
Business impact analysis (BIA) workshop
A workshop with the owners of each area to find out which processes cannot stop and for how long they can hold out.
Stays in Continuity
- Service · Every year
NIS2 and DORA board training
A session so your board understands what it has to decide and oversee in security, adapted to your sector.
Delivered as a report
- Service · Every year
DORA register of information
We prepare the register of information on your arrangements with ICT providers, leave it ready for you to submit to your supervisor and update it every year.
Stays in Third parties
- Service · Every year or every six months
Business continuity exercise
A guided exercise with your management team on a realistic scenario, to test the plan before you need it.
Stays in Continuity
- Service · Every year
Incident response exercise
A full incident response exercise, with the notification to the authority prepared as if it were real.
Delivered as a report
- Service · Every year
Internal audit
The annual internal audit of your security system, by someone who did not implement it.
Delivered as a report
- Service · Every year
Pre-certification audit
We audit your system the way the certification body would, so you can fix things before the real audit.
Delivered as a report
I need a plan I don’t have
3 services
Done once and kept up to date: the continuity plan, the response procedures or a supplier exit plan.
- Service · Once
Business continuity and recovery plan
We write your business continuity plan and your recovery plan from the BIA.
Stays in Continuity
- Service · Once
Incident response playbooks
Five response playbooks for the most likely incidents in your organisation.
Stays in Continuity
- Service · Per supplier
Supplier exit plan
We design how to leave a critical supplier without stopping the processes that depend on it.
Stays in Third parties
Something has happened
2 services
A critical supplier that needs a thorough review, or an incident you need to understand.
- Service · When needed
Supplier audit
We audit a critical supplier in depth when the assessment is not enough.
Stays in Third parties
- Service · When needed
Post-incident review
When a real incident happens, we analyse the causes, the response and what needs to change.
Partly stays in Incidents
I have no one to run it
2 services
Someone to run security with you month after month, or to answer your customers’ questionnaires.
- Service · Every month
Virtual CISO
An external security lead for your organisation. The scope is agreed with you in the proposal.
Partly stays in Compliance
- Service · Every month
Security questionnaire responses
We answer the security questionnaires your customers send you, using your policies and evidence.
Delivered as a report
A customer is assessing me
1 service
For those being assessed: one assessment you share with the customers you choose.
How you start
Onboarding comes with the platform; you choose the rest
Onboarding and initial training come with the platform. Migration, the initial supplier review and the first service are fixed-scope services you can add.
Included
Onboarding and initial training
We set up your workspace and train your team to use the platform.
Service · optional
Data migration from spreadsheets
We bring in your suppliers, risks and controls from spreadsheets or another tool.
Service · optional
Initial supplier review
We classify your suppliers by criticality and send the first questionnaires.
Service · optional
First service
We finish with a real deliverable: a pre-certification audit or an exercise.
How a service is delivered
A BIA workshop, start to finish
The same path applies to all of them: fixed scope, work with your team, and you decide. In this example, the customer uses the platform.
Engagement
Fixed scope
Processes, areas and calendar, in writing in the proposal.
Work
Inside your platform
We work in your Continuity module with the access you grant us.
Decision
You approve the BIA
You approve the recovery times, not us.
Use
It feeds the plans
The approved BIA is the basis of the continuity and recovery plans.
Audit
It stays as evidence
With its version, its date and who approved it.
Next year
It starts from this BIA
The next edition reviews what changed; it does not start from scratch.
Independence and judgement
Independence is what gives an audit its value. That is why:
- We do not issue ISO 27001 or ENS certifications: certification bodies accredited by ENAC do.
- We do not carry out the internal audit of a system we implemented or manage.
Who delivers the services
A cybersecurity compliance professional who prepares organisations for their security audits, with no shortcuts on evidence.
Which service shall we start with?
Tell us what situation you are in and how much time you have, and we will propose the first step.