Where the time goes
NIS2 and DORA turn security from good practice into an obligation with deadlines, fines and personal liability for management. Most companies know roughly where they fall short, but not in the detail an auditor asks for.
What we do for regulated companies
- A gap analysis of access, identities, network exposure, logging, backups, incident response and suppliers, ranked by risk.
- Fixes: single sign-on and least privilege, central logging, backups restored in tests, alerting and an incident process that has been practised.
- Evidence: configuration and test results documented so an auditor can check them, kept current by automated checks.
- Ongoing operation of the measures, with monthly reports.
An example
Take a payments company of 80 people that falls under DORA. In ten working days, the review finds 23 gaps, five of them high risk. In the following six weeks, those five are fixed, backups are restored in a test for the first time, and the auditor receives a folder of evidence.