Cybersecurity and compliance you can prove
Expert help with regulations such as DORA, NIS2 and the AI Act. Assessment, implementation, evidence and ongoing support.
Technical measures + how people behave + evidence
Most consultants look at either the systems or the documents. We also look at the people who make the decisions.
What do you need to resolve?
Pick the situation closest to yours. One more question, and we show you the matching service — with price and timing.
Preparing for a NIS2, DORA or another regulatory audit?
We assess your readiness, identify gaps and prepare the documents, evidence and action plan you need.
Narrow it down:
Recommendation
Readiness and evidence assessment
You understand what is ready, what is missing and what to do before the review.
We compare agreed requirements with available documents and records.
You receive: A gap assessment, organised evidence and next actions.
From €7 900 Usually 3–5 weeks; DORA 3–6
Boundary: Implementation, independent certification and a second regulation are not included.
Your choices will be filled into the form — just add to them.
Recommendation
DORA readiness and evidence pack
Management gets clear DORA priorities to direct budget and effort at the gaps.
We map DORA requirements to your existing documents, contracts and records.
You receive: An assessment, the register of information (up to 20 ICT arrangements) and ordered evidence with an action plan.
From €7 900 Usually 3–6 weeks
Boundary: One supervisory authority; implementation is a separate project.
Your choices will be filled into the form — just add to them.
Recommendation
ISO 27001 certification readiness
You know how close you are to certification and go into the audit with working processes.
A gap analysis against ISO/IEC 27001:2022 and a plan to the certification audit.
You receive: A comparison with the requirements and Annex A controls, a proposed scope and a plan; the programme to certification is quoted separately.
From €4 900 Usually 2–3 weeks
Boundary: We are not a certification body and do not guarantee the audit outcome.
Your choices will be filled into the form — just add to them.
Recommendation
Annual compliance programme
The whole year is planned: assessment, registers, evidence and management reporting — one contract, one accountable specialist.
A DORA or NIS2 assessment and 12 months of an external expert role with 8 expert hours a month.
You receive: Annual plan, registers, evidence, preparation of management decisions and readiness for review.
€24 700 12 months
Boundary: One contract for the year, accepted in stages; extra hours and implementation are agreed separately.
Your choices will be filled into the form — just add to them.
Recommendation
NIS2 quick assessment
In 10 working days you have a preliminary picture against NIS2, the main risks identified and where to start.
An assessment against the NIS2 measures based on interviews and key documents.
You receive: A preliminary status for each measure, the main risks identified, a 90-day plan and a meeting with management.
From €2 900 10 working days
Boundary: Does not check evidence for each requirement; that is the full assessment.
Your choices will be filled into the form — just add to them.
Recommendation
Applicability review
You get clarity on which obligations apply to you and which actions make sense.
We clarify the precise activity, jurisdiction and remaining facts before determining DORA / NIS2 obligations.
You receive: A written conclusion within the agreed scope, supporting reasons and outstanding questions.
From €900 Usually 3–5 working days
Boundary: An initial written applicability analysis, not a legal opinion, readiness assessment or implementation.
Useful resource: Free applicability checklist (TXT)
Your choices will be filled into the form — just add to them.
Recommendation
Management cybersecurity training
Management meets the training requirement and has records to show it.
A practical session for up to 10 members of management, on site or online, with a realistic scenario exercise.
You receive: A programme, attendance record, certificates of participation and a written record of decisions and next actions.
From €1 400 Half a day
Boundary: The certificate confirms participation; it is not a certification by an authority. Staff training is quoted separately.
Your choices will be filled into the form — just add to them.
We do not know which regulatory requirements apply to us
We check applicability and propose a concrete first step.
Narrow it down:
Recommendation
Applicability review
You get clarity on which obligations apply to you and which actions make sense.
We clarify the precise activity, jurisdiction and remaining facts before determining DORA / NIS2 obligations.
You receive: A written conclusion within the agreed scope, supporting reasons and outstanding questions.
From €900 Usually 3–5 working days
Boundary: An initial written applicability analysis, not a legal opinion, readiness assessment or implementation.
Useful resource: Free applicability checklist (TXT)
Your choices will be filled into the form — just add to them.
Recommendation
Clarify the EU connection first
You understand which EU rules reach you through your customers and what they will ask for.
Being based outside the EU does not by itself settle the question. We first identify relevant EU services, customers, entities and requests.
You receive: A defined jurisdiction and question to review, or a referral where local expertise is needed.
Initial conversation By appointment
Boundary: Initial orientation, not a written assessment, emergency response or a commitment to deliver before your deadline.
Useful resource: What an applicability review covers
Your choices will be filled into the form — just add to them.
Recommendation
Readiness and evidence assessment
You understand what is ready, what is missing and what to do before the review.
We compare agreed requirements with available documents and records.
You receive: A gap assessment, organised evidence and next actions.
From €7 900 Usually 3–5 weeks; DORA 3–6
Boundary: Implementation, independent certification and a second regulation are not included.
Your choices will be filled into the form — just add to them.
Recommendation
Cyber Resilience Act (CRA) readiness
You can report vulnerabilities on time and know what the product lacks before December 2027.
Article 14 reporting readiness and, where needed, a product assessment ahead of December 2027.
You receive: A reporting procedure, templates and a vulnerability disclosure policy; the product assessment is from €5 900.
From €2 400 Usually 1–2 weeks
Boundary: We are not a notified body and do not issue CE marking.
Your choices will be filled into the form — just add to them.
A customer wants a questionnaire or documents
We prepare draft answers and evidence and identify what is missing.
Narrow it down:
Recommendation
Customer questionnaire response
You answer the customer review with substantiated statements and evidence you can reuse in later reviews.
We review the request, deadline and available evidence with your team.
You receive: Traceable answers, supporting records and clearly identified gaps.
From €1 300 Typically 5–15 working days
Boundary: Draft answers for your approval, not a certificate, legal opinion or guarantee that the customer will accept them.
Useful resource: Free questionnaire response guide
Your choices will be filled into the form — just add to them.
Recommendation
Bank supplier pack
You move through the bank’s approval with prepared answers and evidence that you reuse with the next financial customers.
For one company and one financial customer: a review of the ICT contract against the DORA Art. 30 clauses and what is reasonable to accept; draft answers to the customer’s security questionnaire; an evidence index you reuse with the next customers; a gap list with owners.
You receive: Included: one financial customer; up to 2 contracts (the main contract and one annex or agreement); one questionnaire of up to 150 questions; up to 2 rounds of clarification with the customer. From you: the contracts, existing policies and available evidence, and one technical contact. Out of scope (quoted separately): further customers or contracts, more questionnaires or portals, legal representation and implementing missing measures.
€3 900 Usually 2–3 weeks
Boundary: Not a legal opinion — legal review of the contract is commissioned separately from a lawyer. Implementing missing measures is agreed separately. Scope is confirmed in writing before work starts.
Your choices will be filled into the form — just add to them.
Recommendation
DORA register diagnostic
You understand which register errors to fix, where they come from and what the correction needs.
We first confirm the format, version and checks that can be performed.
You receive: A report on the agreed checks and a prioritised correction plan; no guarantee of authority acceptance.
€2 600 Around 5 working days
Boundary: Diagnosis only. Corrections and submission are separate; local checks do not guarantee supervisory acceptance.
Useful resource: Trace register validation errors
Your choices will be filled into the form — just add to them.
Recommendation
Readiness and evidence assessment
You understand what is ready, what is missing and what to do before the review.
We compare agreed requirements with available documents and records.
You receive: A gap assessment, organised evidence and next actions.
From €7 900 Usually 3–5 weeks; DORA 3–6
Boundary: Implementation, independent certification and a second regulation are not included.
Your choices will be filled into the form — just add to them.
We have a security or email problem
We clarify the problem, investigate the causes and agree the necessary corrections.
Narrow it down:
Recommendation
The first 24 hours of an incident
You know what to do in the first hours and who decides what.
What to do now: contain, preserve evidence, decide and notify.
You receive: A clear order of actions and who decides what.
Free guide Now
Boundary: Round-the-clock response is provided through a vetted partner under a separate contract; we help with decisions and reporting.
Your choices will be filled into the form — just add to them.
Recommendation
Email and domain review
Your IT team gets evidence and ordered actions instead of changing settings on a guess.
We review agreed domains, senders and signals of problems.
You receive: An assessment and correction plan; inbox placement is not guaranteed.
From €2 400 Typically 5–10 working days
Boundary: Technical fixes and ongoing monitoring are separate. Inbox placement or removal from blocklists is not guaranteed.
Useful resource: Free email-delivery checklist
Your choices will be filled into the form — just add to them.
Recommendation
Review the near miss and payment decisions
Leaders practise how to verify suspicious requests and decide under pressure.
We first clarify what happened and whether the immediate risk has been contained. A separately commissioned fraud-decision workshop can then rehearse payment checks and escalation.
You receive: An agreed workshop scope, scenarios and a written decision protocol if commissioned.
Standalone workshop: by quotation Session and preparation agreed in advance
Boundary: Training and decision practice, not investigation, technical containment or an assessment of individual employees.
Useful resource: How to verify payment requests
Your choices will be filled into the form — just add to them.
Recommendation
AI use review
Teams get clear rules for useful AI use and protection of company information.
We clarify the tools, your role, the data and how AI is used.
You receive: An inventory of identified uses, a risk register and approval rules.
From €5 900 Typically 3–4 weeks
Boundary: An assessment using interviews and records, not continuous detection of hidden AI or full high-risk AI compliance.
Useful resource: AI data and output rules
Your choices will be filled into the form — just add to them.
Recommendation
Cyber incident exercise
People know who decides and who reports before a real incident happens.
A tabletop exercise for management and teams on a scenario from your environment.
You receive: The scenario, a written record of decisions and timings, and an improvement plan.
From €1 900 Half a day
Boundary: No attacks or technical tests on live systems.
Your choices will be filled into the form — just add to them.
Recommendation
Microsoft 365 and account security
A review of admin rights, multi-factor sign-in, sharing, mail rules and logging.
You receive: Findings ranked by risk and a change plan; improvements are quoted separately.
From €1 900 for the review Usually 1–2 weeks
Boundary: Up to 100 users, read-only access for the review.
Your choices will be filled into the form — just add to them.
Recommendation
Restore test
A controlled restore of an important system in a separate environment.
You receive: A measured recovery time for the chosen scenario, gaps and fixes.
From €1 900 for the test Usually 1–2 weeks
Boundary: One system and one scenario; the continuity plan is quoted separately.
Your choices will be filled into the form — just add to them.
Recommendation
Review of the specific risk
You get concrete priorities and agreed fixes with the result verified.
We define the affected systems and authorised checks. Changes are commissioned separately.
You receive: Findings, priorities and verifiable next actions.
By written quotation Schedule agreed after scoping
Boundary: Not emergency response, continuous monitoring or a guarantee against future incidents. Implementation is separately commissioned.
Useful resource: Free MDR / SOC acceptance scorecard (TXT)
Your choices will be filled into the form — just add to them.
We need ongoing expert support
We organise agreed tasks, responsibilities and checks alongside your team.
Narrow it down:
Recommendation
External expert roles: vCISO and other agreed functions
You have a specialist who moves the agreed work forward and shows management the progress.
We clarify responsibilities, priorities and the capacity required.
You receive: A defined role, agreed work and reporting arrangements.
From €1 400 / month Monthly agreed capacity
Boundary: Not unlimited availability or 24/7 incident response. Management retains its legal accountability.
Useful resource: Free CaaS scope worksheet (TXT)
Your choices will be filled into the form — just add to them.
Recommendation
Understand the security role you need
You understand which role you need and how much, before committing to a monthly plan.
Start with responsibilities and existing coverage before estimating days or choosing a monthly plan.
You receive: A shared understanding of the missing responsibilities and whether security leadership, recurring compliance support or an internal role is the useful next step.
Initial conversation By appointment
Boundary: Initial orientation, not a written assessment, emergency response or a commitment to deliver before your deadline.
Useful resource: Free worksheet: define the responsibilities (TXT)
Your choices will be filled into the form — just add to them.
Recommendation
Agreed technical improvements
The assessment recommendations become implemented and verified changes.
Define the changes, authorised access, change window and acceptance checks before commissioning implementation.
You receive: Findings, priorities and verifiable next actions.
By written quotation Schedule agreed after scoping
Boundary: Not emergency response, continuous monitoring or a guarantee against future incidents. Implementation is separately commissioned.
Your choices will be filled into the form — just add to them.
Recommendation
Annual compliance programme
The whole year is planned: assessment, registers, evidence and management reporting — one contract, one accountable specialist.
A DORA or NIS2 assessment and 12 months of an external expert role with 8 expert hours a month.
You receive: Annual plan, registers, evidence, preparation of management decisions and readiness for review.
€24 700 12 months
Boundary: One contract for the year, accepted in stages; extra hours and implementation are agreed separately.
Your choices will be filled into the form — just add to them.
Recommendation
DORA roadmap implementation
The DORA plan gets delivered and every measure keeps its evidence for the supervisor.
A separately commissioned implementation project following an agreed assessment.
You receive: Findings, priorities and verifiable next actions.
From €9 900 Schedule agreed after scoping
Boundary: The assessment is not included. A limited email or configuration fix is quoted to its own scope.
Your choices will be filled into the form — just add to them.
A municipality or public body
We help with the Bulgarian Cybersecurity Act obligations, documents and practical measures.
Narrow it down:
Recommendation
NIS2 quick assessment
In 10 working days you have a preliminary picture against NIS2, the main risks identified and where to start.
An assessment against the NIS2 measures based on interviews and key documents.
You receive: A preliminary status for each measure, the main risks identified, a 90-day plan and a meeting with management.
From €2 900 10 working days
Boundary: Does not check evidence for each requirement; that is the full assessment.
Your choices will be filled into the form — just add to them.
Recommendation
Assessment under the Bulgarian Cybersecurity Act
Where the administration stands against the Act and the ordinance.
You receive: A requirement–status–evidence–gap–action matrix and an ordered plan for management.
From €7 900 Usually 3–5 weeks
Boundary: Implementation is quoted separately.
Your choices will be filled into the form — just add to them.
Recommendation
Annual programme for a municipality
The assessment plus twelve months of an external expert role.
You receive: Plan, registers, management decisions, reporting readiness and training.
€24 700 12 months
Boundary: One contract for the year; implementation is quoted separately.
Your choices will be filled into the form — just add to them.
Recommendation
Annual internal cybersecurity audit
You meet the internal-audit requirement and see which measures work in practice.
An independent internal audit against the Bulgarian ordinance, the Act and ISO 27001, by a third party on your behalf.
You receive: An annual programme, a report with nonconformities and deadlines, a management summary.
From €3 900 Usually 2–3 weeks
Boundary: Not a certification audit; we do not audit our own work.
Your choices will be filled into the form — just add to them.
Recommendation
Information system acceptance check
A check of the agreed acceptance criteria, access, backup and data export.
You receive: An acceptance checklist, blocking and non-blocking findings and a recommendation.
From €2 400 for the check Usually 2–3 weeks
Boundary: One system, one stage, up to 30 criteria; the acceptance decision is yours.
Your choices will be filled into the form — just add to them.
Recommendation
Management cybersecurity training
Management meets the training requirement and has records to show it.
A practical session for up to 10 members of management, on site or online, with a realistic scenario exercise.
You receive: A programme, attendance record, certificates of participation and a written record of decisions and next actions.
From €1 400 Half a day
Boundary: The certificate confirms participation; it is not a certification by an authority. Staff training is quoted separately.
Your choices will be filled into the form — just add to them.
Recommendation
External data protection officer
An independent DPO or support for your internal one.
You receive: A review of processing, access, retention and processor contracts.
By written quotation Agreed monthly scope
Boundary: Independence and capacity are checked before we agree.
Your choices will be filled into the form — just add to them.
Recommendation
Incident readiness and reporting
We prepare the administration to respond and report on time.
You receive: Contacts and escalation, significant-incident criteria, reporting templates and a rehearsed scenario.
By written quotation Agreed timeline
Boundary: Technical containment and round-the-clock response are provided through a vetted partner under a separate contract.
Your choices will be filled into the form — just add to them.
Another situation?
Describe your case in your own words — we reply within one business day. If you prefer to explore on your own, see all services and prices.
See what you receive before you commission it
In a readiness assessment we organise risks, evidence and next actions into documents your management, auditor and customers can use: a risk register, an evidence index and an action plan with owners and deadlines.
View sample deliverablesWhere to start
Selected services with starting prices. Scope and price are confirmed in writing before work starts.
| Service | What you receive | Price | Timing |
|---|---|---|---|
| NIS2 quick assessment | A preliminary status against the NIS2 measures, the main risks identified and a 90-day plan. | from €2 900 | 10 working days |
| Management training | The training NIS2 requires of management: half a day, an exercise, a written record and certificates. | from €1 400 | Half a day |
| NIS2 or DORA readiness and evidence pack | A requirement–status–evidence–gap–action matrix and organised evidence for the review. | from €7 900 | NIS2: 3–5 weeks; DORA: 3–6 weeks |
| Bank supplier pack | DORA contract-clause review, answers to the bank’s questionnaire and an evidence index. | €3 900 | Usually 2–3 weeks |
| External expert role | A designated specialist moves security and compliance forward every month (vCISO and other roles). | from €1 400 / month | Monthly |
| Annual compliance programme | The assessment plus 12 months of an external expert role in one contract. | €24 700 | 12 months |
After the assessment we can also implement the solutions — architecture, safeguards and fixes. Security improvements.
How we start
- 1ConversationDescribe the problem and deadline.
- 2QuotationWritten scope, outputs, price and timeline within 2 business days after we receive the information needed.
- 3WorkWe perform only the commissioned assessment, preparation or changes.
- 4HandoverWe review the output with you, clarify open items and agree the next actions.
Tell us which problem you want to resolve
No technical brief is needed. Describe the situation and any deadline.
Describe your problem