Gap analysis scoped against the engineering capacity you actually have, a dated path to close it, and evidence packages written the way an auditor reads them.
They overlap more than the consultancies suggest. Implement once, evidence three times.
Applies to essential and important entities, and reaches their suppliers through contract. Management bodies are personally accountable for approving risk-management measures.
The certification most customers ask for by name. We take you from gap analysis to a Stage 2 audit that does not produce major nonconformities.
For financial entities and their critical ICT providers. Heavier on testing and third-party register obligations than most teams expect going in.
We audit the controls you actually operate, not the ones the policy describes. The output is a list of gaps with an estimate of the engineering effort each one costs to close.
Gaps are sequenced against your delivery calendar and your headcount. If the plan requires capacity you do not have, it is not a plan, and we will say so.
We write the evidence, your engineers own the control. A programme that depends on the consultancy staying is a programme that fails at renewal.
Evidence packages prepared the way an auditor reads them, and a quarterly report short enough that your management body actually reviews it.
“Certification means we are secure.”
It means a management system exists and is being followed. Every organisation we have responded to an incident for held at least one certificate.
“We are too small for NIS2.”
Size thresholds apply to named sectors. Obligations reach smaller suppliers through customer contracts, which is how most organisations first encounter them.
“We can do this in a quarter.”
A first ISO 27001 certification typically takes eight to twelve months from a standing start. Anyone promising a quarter is selling documents, not a system.
A gap analysis takes three weeks and tells you what the next twelve months cost.
Request a gap analysis