If you operate in a critical sector (Energy, Transport, Health, Banking, Digital Infrastructure) and meet specific size criteria, yes. We help you verify your exact classification (Essential vs. Important entity) as the first step of the audit.
ISO 27001 is a great foundation, getting you roughly 70% of the way there. However, NIS2 and DORA have specific, stricter requirements regarding incident reporting timelines (24 hours) and supply chain security that ISO does not strictly mandate. We focus specifically on bridging that gap.
No. The "Shared Responsibility Model" applies. Microsoft secures the cloud infrastructure, but you are legally responsible for securing what is in the cloud (your data, identities, and apps). Our audit covers your half of the responsibility.
Beyond the financial fines (up to 2% of global turnover), top management can face personal liability. This means Board members can be held individually accountable for failing to oversee cybersecurity measures, potentially leading to suspension from their roles.
Yes. The Supply Chain Audit module of our engagement specifically assesses how you verify and manage your ICT vendors, which is a core pillar of the DORA regulation.
