Technical controls that support your GDPR and NIS2 work
We help you put the technical security measures in place that GDPR and NIS2 expect, and document them. Legal interpretation stays with your counsel.
What is included
- Gap review
- We compare your current technical controls with GDPR Article 32 and the NIS2 risk-management measures.
- Encryption
- We set up encryption in transit and at rest, and manage the keys.
- Access control
- We add multi-factor authentication, role-based access and access reviews.
- Logging and detection
- We set up audit trails and alerting that support incident handling and reporting.
- Backup and restore
- We set up tested backups and documented restore procedures for continuity.
- Evidence pack
- We provide configuration records, procedures and test results your auditor or lawyer can review.
How it works
Review. We look at your systems, data flows and existing documentation.
What you receiveA gap list mapped to the relevant requirements.
Prioritise. We rank gaps by risk and effort, and mark the quick fixes.
What you receiveA phased roadmap.
Implement. We apply the technical controls on systems we host or manage.
What you receiveWorking controls and change records.
Document. We collect evidence and describe each control in plain language.
What you receiveAn evidence pack for your compliance file.
Right for you if
NIS2 may apply to you, or to clients who rely on you as a supplier.
Your GDPR documentation describes controls that do not yet exist.
You need technical help alongside your legal advisers.
Questions
Do you tell us whether NIS2 applies to us?
No. Applicability is a legal question for your counsel. We can support it with technical facts about your systems.
Does this make us compliant?
Compliance also depends on governance, contracts and processes. We cover the technical side and document it.
Can you help with incident reporting duties?
We set up the logging and procedures you need to meet reporting deadlines. The notification itself is filed by your organisation.
We already hold ISO 27001. Is this still useful?
It can be. We focus on whether the technical controls work in practice on your systems.