Cybersecurity Europe
Supporting security programmes across the European regulatory environment.
From our base in the Netherlands, we take on engagements across the EU, for organisations navigating NIS2, GDPR, and the broader shift toward mandatory cybersecurity risk management that's now spreading across the bloc.
The EU regulatory shift
NIS2 has significantly widened the scope of organisations across the EU with formal cybersecurity obligations, pulling in mid-sized companies across sectors that previously sat outside regulated critical infrastructure.
GDPR remains the baseline for data protection across every member state, with security measures a required part of demonstrating compliance rather than optional best practice.
For financial services specifically, DORA (the Digital Operational Resilience Act) adds ICT risk-management requirements on top of NIS2 and GDPR. And the EU Cyber Resilience Act is reshaping security requirements for products with digital elements sold into the EU market.
Regulatory requirements vary by sector and member state. The above is general context, not legal advice for your specific situation.
Where EU engagements typically focus
Cross-border organisations most often bring us in for governance and regulatory alignment spanning multiple jurisdictions, cloud security across multi-region deployments, and supply-chain and third-party risk work driven by NIS2's expanded supplier obligations.
Frequently asked questions
Do you work with organisations outside the Netherlands?
Yes. The Netherlands is our primary market, and we take on engagements across the EU where the work calls for it, particularly for organisations with cross-border regulatory obligations.
Which EU regulations are most relevant to your work?
NIS2 and GDPR most often, with ISO 27001 as the common technical baseline. Where relevant to a client's sector, financial services in particular, DORA and the EU Cyber Resilience Act also come into scope.
Do engagements run in English?
Yes, English is our primary working language for EU engagements, alongside Dutch for Netherlands-based clients.
How do you handle time zones for engagements outside CET?
Most EU engagements are within one or two hours of CET, which keeps scheduling straightforward. We agree working hours and response expectations as part of scoping any engagement.
Do you have physical offices across Europe?
No. We're based in Utrecht, and EU engagements are delivered remotely with travel arranged where an engagement genuinely calls for it (a workshop, a tabletop exercise, an on-site assessment). We won't claim a physical presence we don't have.
Does ISO 27001 certification transfer across EU member states?
Yes. ISO 27001 is an international standard, and certification is recognised across the EU and beyond, which is part of why it's such a common baseline for cross-border B2B relationships.