When it fits
Operators and service providers that may fall within national NIS2 rules, and leaders preparing for customer assessments, supervisory enquiries or internal governance reviews.
Why look closer
NIS2 requires relevant entities to manage cyber risks through proportionate organisational and technical measures. The exact duties and the national scope must be confirmed for each organisation.
What's included
- Classification as an entity in scope, operating jurisdiction and regulatory scope, as orientation
- Risk management, governance and management oversight
- Incident handling, reporting workflows and continuity
- Supplier risks, access governance and security evidence
- Targeted validation of automated control assessments
Can the software do all of this?
A platform can detect that an incident response policy exists; it cannot infer from the document alone that escalation works under pressure. Scope errors and unconnected systems can undermine apparently complete reports.
How it works
- Agree scope and prioritiesTogether we define what is reviewed and what is not.
- Review documents and available tool outputsWe evaluate documents and the available outputs of your tools.
- Validate selected control evidenceWe test the evidence for the most important controls in a targeted way.
- Discuss findings and practical next stepsWe discuss the findings and the practical next steps.
Your result
A scoped gap register, an evidence-quality assessment, a prioritised remediation roadmap and a management briefing.
Scope and limits
The classification is professional orientation, not legal advice. Work is limited to the scope agreed with the client; access to systems, documents and staff is subject to your approval.
We are auditors and consultants, not lawyers. This service is not legal advice.