Our Solutions · Governance & Compliance
Being secure is not enough. You need to be able to prove it.
We assess where your business really stands — backed by evidence, traceable and presented in a form you can substantiate to management, clients and authorities.
Even if you are not directly in scope, you will be asked.
The NISG 2026 enters into force on 1 October 2026. Entities in scope must register by 31 December 2026.
Entities in scope are required to manage the security of their supply chain. Your clients will pass this obligation on — through questionnaires, contractual clauses and requirements for evidence.
Businesses that can provide a clear, substantiated response within a few days have an advantage in procurement. Those that cannot lose time — or the contract.
Whether your business falls directly within scope depends on its sector classification. This should be established with evidence rather than assumed.
First, understand where you stand.
An assessment is only as valuable as what you can do with it afterwards. That is why we provide multiple formats for different audiences.
Duration
Four to five weeks from kick-off
Your Time Commitment
Around two person-days spread across the entire engagement
Price
Fixed price, rather than time-based billing
Included
Technical review, management presentation and a follow-up after 30 days
What you receive.
1
Executive Summary
No more than five pages: an overview of your current position, the five key risks in business terms, the effort and impact of the proposed actions, and a clear recommendation. Free of jargon and ready to use in a meeting.
2
Detailed Report
For each finding: the facts, supporting evidence, risk assessment, recommendation, estimated effort and a suitable owner.
3
Maturity Profile
Your current position in each area on a scale from 0 to 5, alongside a jointly agreed target for the next twelve months. The same chart becomes your progress measure a year later.
4
Action Backlog
Prioritised by impact and effort, organised into immediate actions, a 90-day horizon and a 12-month horizon. Ready to incorporate into your planning without retyping.
5
Tool & Licence Map
What you have, where capabilities overlap, what you pay for but do not use, and what is genuinely missing. This regularly identifies savings as well as investment needs.
6
NIS2 Applicability Assessment
A documented, dated assessment with supporting reasoning — providing evidence for management, clients and authorities.
7
Reusable Responses for Client Questionnaires
A prepared, evidence-backed account of your security measures. This enables you to complete client security questionnaires in hours rather than days.
8
Make-or-Buy Assessment
For each major action, an assessment of whether it is best delivered in-house, through your existing partner or as a managed service.
Assessed against established frameworks.
Our assessments follow established criteria, so the results stand up to scrutiny from clients and auditors.
- Technical: CIS Controls v8.1, using Implementation Groups IG1 and IG2 as realistic benchmarks for mid-sized businesses.
- Regulatory: mapping to the risk management measures under NIS2 or the NISG 2026 — so the gap analysis is ready when needed.
- Organisational: the structure of ISO/IEC 27001, without turning the assessment into a certification project.
Maturity scale: From 0 (absent), through 2 (in place but dependent on individuals) and 3 (defined and documented), to 5 (managed and measured).
For most areas, level 3 is the economically sensible target. We recommend level 5 only where the business requires it.
How We Work
We collect configuration details, analysis results and evidence without making changes to your systems. No penetration testing, no exploitation of vulnerabilities and no disruption to operations. All access is agreed in advance and logged.
See also the five principles under “What you can expect from us” on our homepage.
We support your security lead. We do not take their place.
A newly created information security role rarely fails for lack of expertise. It fails because the mandate is unclear, support is missing in difficult conversations, and decisions are made in isolation. That is where we help.
What this is not:
a replacement for your security lead, a shadow role or a way to outsource their responsibilities. Your security lead owns the agenda, reports to management and makes the decisions.
Role Definition
The mandate, responsibilities, boundaries with IT operations, reporting lines and escalation paths are set out in writing. This prevents most friction before it arises.
One-off, one day
Regular Advisory Sessions
A scheduled monthly session, plus time reserved for questions at short notice. Your security lead sets the topics: upcoming decisions, wording for sensitive conversations and proposal evaluations.
Monthly
Practical Tools, Not Paperwork
Policy templates aligned with Austrian law, a risk register, an action backlog, a manageable set of five metrics and a reporting template for management.
Included
Presentation Preparation
Before each report to management, we review the content, structure and likely objections together. Anyone presenting a security budget for the first time should know the questions before they are asked.
As needed
Hands-on Expert Support
We contribute directly where needed — during migrations, segmentation projects and responses to client questionnaires. Our support goes beyond advice.
As needed
Support When an Incident Strikes
A named, experienced point of contact with a defined response time when an incident occurs.
Included
Additional Services
NIS2 / NISG
Evidence-backed applicability assessment, registration and implementation of technical and organisational requirements.
DORA
Implementation for financial services providers, including management of your ICT third-party providers.
ISO 27001
Phased development of a management system through to certification readiness, while day-to-day operations continue.
GDPR & Data Protection
External data protection officers, gap analyses and a record of processing activities that is actively maintained rather than simply filed away.
Certified Data Protection Expertise
Supplier & Third-Party Risk
Dependencies on external partners are managed systematically — helping you answer the same questions your own clients will ask you.
Third-Party Risk Management
Penetration Testing & Audits
Technical evidence that stands up to audit scrutiny — repeatable rather than a one-off exercise.
Horizon3.ai NodeZero, Manual Testing
OT Security / IEC 62443
Standards-compliant security for production and industrial systems, backed by a client project for an industrial group.
IEC 62443
What We Leave Out:
We assess and charge only for what is relevant to your environment. If you do not use Microsoft 365, the corresponding modules are excluded unless that changes. Areas that do not exist in your organisation are not included in our proposal.
Free initial consultation – a proposal within 24 hours.