Cybersecurity Consulting
Regulatory Cybersecurity Compliance Consulting
We map your regulator's information systems provisions to your controls one by one. We close gaps with evidence you can present in an audit.
What it is
Financial and energy regulators set detailed rules for the information systems of the organizations they supervise. These rules cover areas from penetration testing to incident response plans and outsourcing contracts. In the EU, DORA and NIS2 add comparable duties for financial entities and for essential and important entities. The work maps each provision to a control, an owner and a piece of evidence.
Scope
- Turning the regulation's information systems provisions into a control checklist
- Matching each provision to the existing control, its owner and its evidence
- Addressing earlier audit findings together with their root causes
- Reviewing outsourcing and cloud contracts against the clauses the regulation requires
- Bringing the incident response plan and its yearly test up to what the regulation asks for
- Preparing the evidence file for the auditor
The need
When organizations need it
- When the same findings recur year after year in the independent IT audit.
- When your regulator issues new information systems rules or changes existing ones.
- When DORA or NIS2 requirements reach you directly or through an EU customer.
Method
How we work
-
Provision list
We turn the regulation's information systems provisions into an auditable control checklist.
-
Mapping
We match each provision to your existing control, its owner and its evidence. A provision without evidence is counted as a gap.
-
Closing gaps
We rank the gaps by risk and audit schedule and implement the technical controls with your teams.
-
Audit readiness
We arrange the evidence file in the order of the provisions. We verify critical controls with a test.
Outcome
What you have at the end
You have a mapping table that shows the control, owner and evidence for every provision of the regulation. The evidence an auditor will request is ready in one file, in the order of the provisions.
Frequently asked questions
Can the firm that consults for us also perform our audit?
Often not. Some regulators bar the firm that consulted on the controls from performing the first audit. We clarify your regulator's independence requirements at the start.
We are subject to several regulations. Do we need separate projects?
No. We meet shared provisions with a single control and map it to each regulation separately. For example, one incident response plan can meet the expectations of several regulators.
Does this replace the independent audit?
No. The audit required by the regulation is carried out by an authorized independent party. We prepare your controls and evidence for it.
Cybersecurity Consulting
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting