Govern · Governance, Risk & Compliance
Governance, Risk & Compliance
Compliance frameworks exist to prove a security programme works. They shouldn't be the reason it exists. We build governance that produces real risk reduction, with the evidence trail as a natural side effect.
Delivered from our base in Utrecht, available to organisations across the Netherlands.
The problem
Compliance work done backwards (writing policies to satisfy an auditor rather than building controls that actually run) produces a certificate and very little real security improvement. It also tends to fail the next audit cycle, because policies that don't reflect real practice drift further from reality every year.
Business impact
Beyond the direct cost of non-compliance (fines under NIS2 and GDPR, lost deals that require SOC 2 or ISO 27001), poorly implemented governance leaves the underlying risks the framework was meant to address genuinely unmanaged. The certificate exists, the risk doesn't go away.
Aligned to the frameworks most relevant to organisations operating in the Netherlands and the EU.
ISO 27001
Gap assessment, implementation support and audit readiness for certification or alignment without pursuing formal certification.
NIS2
Interpreting what the directive actually requires of your organisation, and closing the gaps that matter. See our NIS2 readiness guide for a deeper walkthrough.
GDPR security alignment
The technical and organisational measures GDPR requires, implemented rather than just documented.
SOC 2 readiness
Preparing for a SOC 2 audit with controls that will actually hold up under evidence review, common for SaaS companies selling into the US market.
NIST CSF & CIS Controls
Using recognised frameworks as a structure for a programme, not as a compliance exercise in isolation.
Cyber resilience
Governance that accounts for operational resilience requirements, increasingly relevant as DORA and the EU Cyber Resilience Act expand what 'compliant' means.
Supplier security & audit evidence
Governance processes that produce evidence as a by-product, instead of a last-minute scramble before an audit.
Where the evidence actually comes from
Most ISO 27001 and NIS2 control evidence isn't a document you write once. It's a by-product of how your technical environment is actually configured and run. Conditional Access policies and audit logging in Microsoft 365 and Entra ID map directly onto access-control and logging requirements. Configuration baselines and monitoring in your Azure, AWS or GCP environment do the same for infrastructure controls. Where AI features are in scope, our AI security review feeds the same risk register rather than sitting in a separate silo. Building the governance layer without touching the technical layer underneath it is how programmes end up with a certificate and very little real risk reduction.
How this engagement runs
Assess
Understand the current state, real risk, and what's actually driving the need for this work.
Architect
Design the controls and approach that fit your environment, not a generic template.
Implement
Deploy and integrate the work: configuration, code, or process, whichever the engagement calls for.
Validate
Test that it actually holds up, rather than assuming it does because it's been deployed.
Improve
Feed findings back in as your environment and the threat landscape change.
Who this is for
- Organisations newly in scope for NIS2 who need to understand what it actually requires
- Companies pursuing ISO 27001 or SOC 2 certification for the first time
- Businesses whose existing compliance programme feels like paperwork disconnected from real security
- Organisations expanding into markets with additional regulatory requirements (DORA, Cyber Resilience Act)
What you get
- A gap assessment against your target framework
- An implemented ISMS or control set, not just policy documents
- A risk register reflecting your actual environment
- Audit-ready evidence generated as a by-product of running the programme
- Ongoing support through certification or regulatory audit
Frequently asked questions
Do we need ISO 27001 or NIS2, or both?
They're not mutually exclusive and often reinforce each other. NIS2 is a legal obligation for organisations in scope; ISO 27001 is a certifiable standard many organisations pursue regardless of NIS2 status because customers ask for it. Many organisations end up needing both, and a well-designed ISMS can support NIS2 compliance evidence at the same time.
Can you help us prepare for ISO 27001 certification specifically?
Yes. Gap assessment, ISMS design, control implementation and internal audit preparation, working toward the actual certification audit with an accredited certification body.
What does GRC work actually produce, day to day?
Policies, yes, but more importantly: implemented controls, evidence that those controls run continuously (not just at audit time), and a risk register that reflects your actual environment rather than a generic template.
Does NIS2 require security training?
For management specifically, yes. Article 20 requires management bodies to follow training so they have sufficient knowledge to identify, assess and approve the handling of cybersecurity risk. We're not a training vendor running generic awareness courses; this obligation is something our NIS2 governance work covers directly, as part of setting up management accountability and reporting lines in the first place.