GUIDED PROGRAMME
A clear route from assessment to outcome.
NIS2, ISO 27001 or the EU AI Act. We start with a baseline assessment, set clear priorities, and work step by step towards a demonstrable outcome.
Complying with the EU AI Act, NIS2, preparing for ISO 27001, or structurally addressing a specific risk: every programme has a starting point, an end goal, and a clear route between them.
Who is this for?
Organisations that want to make demonstrable progress towards NIS2, ISO 27001, the EU AI Act, or a specific risk objective.
What you can expect
We always start with a baseline assessment – an honest picture of the current situation, without unnecessary reporting. From that foundation, we agree a practical route forward: step by step, with your people, not over their heads.
- NIS2 / DORA / Cyber Resilience Act : from baseline assessment to demonstrable progress
- ISO 27001: gap analysis, policy development, internal audit guidance
- EU AI Act: AI inventory, risk classification, transparency implementation
- Risk analysis: identifying, assessing and prioritising risks
The result is demonstrable – something you can show to customers, regulators, or an insurer.
A practical approach in four steps
01
Baseline assessment
No assumptions, just facts. We map out what’s already in place, what’s missing, and where the main points of attention lie.
02
Priorities
Not a long action list, but clear choices. We determine what’s needed, when it happens, and who’s involved.
03
Execution
No reports that disappear into a drawer. We make sure measures are carried out, ownership is assigned, and progress stays visible.
04
Demonstrable result
Not a paper exercise. A demonstrable result for customers, partners, regulators and insurers.
Practical details
Starting point
Factual basis
No program without a clear picture of the current situation.
Duration
3–12 months
The pace is determined by your priorities and available capacity.
Fee
Tailored
Clear agreements up front, with a focus on outcomes rather than hours.
Frameworks
NIS2, ISO 27001, EU AI Act, EU Cyber Resilience Act
Only what’s relevant to your organisation. Nothing more, nothing less.
Technical execution
Specialist expertise
Where needed, we work with specialised partners. Only when it adds value.
What I don’t do
I don’t carry out pentests, implement software, or build systems. For technical execution, I work together with certified partners. My role is strategic and governance-focused – the link between technology and policy, between risk and decision.
Not sure which approach fits your situation? A 30-minute introductory conversation is usually enough to find out.
Schedule a conversation →Or take a look at the other ways of working together: