Cybersecurity compliance
We establish which security requirements apply to your company and what is missing to meet them. We prepare the documentation and the action plan so the company can respond to clients, auditors and authorities.
What you receive
- List of relevant NIS2, ISO 27001, GDPR and contractual requirements
- Report on the current position against the requirements
- Identified and assessed risks, each with an owner
- Security policy, access control, incidents, backup, suppliers
When it helps
- The company needs to find out whether NIS2 applies to it and what its obligations are.
- A client wants a completed security questionnaire or evidence of compliance.
- The company is preparing for ISO 27001 certification.
- Security policies are missing or no longer reflect how people actually work.
Activities and deliverables
Applicable requirements review
List of relevant NIS2, ISO 27001, GDPR and contractual requirements
Gap analysis
Report on the current position against the requirements
Risk register
Identified and assessed risks, each with an owner
Security policies and procedures
Security policy, access control, incidents, backup, suppliers
Action plan
Prioritised actions with deadlines and owners
Security questionnaires
Answers for clients, based on the company's documentation
What we aim for
The objectives of the engagement, not guaranteed results.
- A clear picture of the applicable requirements and the gaps.
- Policies and registers that reflect real practice.
- A prioritised action plan with named owners.
- Consistent answers to clients' security questionnaires.
What the result depends on
The outcome depends on the company's legal position, access to the relevant systems and information, the resources allocated to technical measures and management's approval of the policies. Legal interpretation of the obligations remains with the company's legal adviser.
Responsibilities and limits
What UDG Group does
- Review the requirements and the current position.
- Draft the policies and registers.
- Propose and prioritise the measures.
- Prepare answers for clients and auditors.
What stays with your company
- Provides access to information and people.
- Approves the policies and accepts the residual risks.
- Implements the measures or approves their implementation.
What is not included
- Certification or accredited audit.
- Legal advice on the company's legal position.
- Any guarantee of compliance following an inspection by the authorities.
Steps
Scoping
Which requirements apply and which systems are in scope.
Gap analysis
The current position against the requirements, based on documents and interviews.
Documentation
Policies, registers and procedures.
Action plan
Priorities, owners and deadlines.
Follow-up
Checking implementation and preparing for audit, if agreed.
What affects timing and cost
Scope, timing and cost are agreed in writing before any work starts.
- The number of standards and requirements covered.
- The size of the company and the number of systems in scope.
- The documentation already in place.
- Whether implementation of technical measures is included.
Frequently asked questions
What is NIS2?
NIS2 is the EU directive on the security of network and information systems, transposed into national law. It applies mainly to medium-sized and large organisations in the sectors listed in its annexes, which are classed as essential or important entities, and to some others regardless of size. It requires risk-management measures, management accountability and incident reporting. Whether it applies is checked for each company.
Will this service get us ISO 27001 certification?
We prepare the documentation and organisation the standard requires. Certification is issued by an accredited body after its own audit.
Do you also work on GDPR?
On the technical and organisational security measures, yes. The legal aspects of data processing remain with your legal adviser or data protection officer.
Related services
Discuss this service
Tell us briefly about the context: your deadline, what you already have in place and the result you are aiming for.
We treat every enquiry with discretion. We can sign a mutual NDA before discussing sensitive information.
If you do not use an email app, copy the address and write to us from your own account.
We use the details in your message to reply to you. More in our privacy policy.