Frequently asked questions

We help organisations assess their security risks, organise the work on applicable requirements and prepare verifiable results for management, clients and auditors. We combine technical expertise, regulatory experience and work on human factors. Every project has defined tasks, deliverables and a designated engagement lead.

We start from the reason you are asking. If you need an audit or a review under DORA or NIS2, we look at the requirements and the evidence you already hold. If the problem is e-mail, a domain or impersonation of your brand, the Email, domain and impersonation audit is the natural starting point. If staff are using unapproved AI tools, we begin with an inventory and an assessment of the uses. If you already know the problem, you do not have to commission an unrelated preliminary audit.

Yes. Our sample deliverables page shows short, illustrative examples for each service — an email and domain finding, a regulatory-evidence index and an AI-use inventory entry — so you can see how we organise the information before you commission anything.

No. The public examples are demonstration examples and are clearly labelled as such. They are not client cases, completed assessments or evidence of achieved compliance. Your own deliverables depend on the agreed scope.

We clarify the type of organisation, the problem, the deadline and the expected result. The conversation creates no obligation. We tell you whether our services fit and what further information a proposal would need; complex questions of regulatory applicability may require a paid review of documents, agreed in advance.

Yes, when the problem and scope fit. Headcount alone does not decide whether we can help, and not every regulation applies to every small organisation. A sole trader or a five-person office may still need help with e-mail and domain problems, AI use, customer security requirements or practical technical security.

We will tell you. The first conversation is not a commitment to commission work. We propose paid work only when a factual review or a defined change would be useful, and you see the written scope and price before deciding.

A short description of your activity, the approximate size of the organisation, the countries you operate in and the reason you are seeking help. If there is a letter from a regulator, a questionnaire from a customer or an audit deadline, mention it. No passwords, sensitive technical details or lists of personal data are needed for the first contact.

The published starting prices apply to the base scope described for each service. Before work begins we confirm the entities, systems, contracts, meetings and deliverables included and record them in the quote. Additional work is agreed separately.

The starting prices published on this site are €2 400 for the Email, domain and impersonation audit, €7 900 for the DORA / NIS2 readiness and evidence pack (the DORA track has the same starting price) and €5 900 for the AI use and governance review. The DORA/NIS2 applicability note starts at €900. External roles start at €1 400 per month. Scope and final price are confirmed in a written quote; the Scope page lists what each base scope includes.

The written quote states the payment schedule before work begins. You have 10 working days to review the deliverable and one round of corrections within the agreed scope is included. Monthly support is invoiced monthly.

CaaS is ongoing support for agreed cybersecurity and ICT-risk compliance responsibilities: deadlines, evidence, action tracking and management reporting. Monthly capacity and outputs are defined in writing. An external CISO / vCISO (virtual chief information security officer) can provide security leadership under a separate or combined agreed scope. Other specialist functions are scoped separately. This is not certification, unlimited work or a guarantee of regulatory acceptance. See the CaaS scope and monthly capacity.

One expert day is eight hours of work and may be used in parts. Preparation, analysis, meetings, written responses and agreed coordination count towards that time. Unused time up to half the monthly allowance may be used in the following month, after which it expires. For example, two days of monthly support can carry forward at most one unused day. Additional work is agreed in advance.

Assessment and implementation are separate engagements. Their combined starting budget for the base scopes is €17 800: €7 900 for the assessment and from €9 900 for implementation. The implementation quotation identifies the specific changes. You are not required to commission implementation from Dyasol.

Reviewing contractual clauses and processing information for the register are different tasks. Separate fees may apply if both exceed the included scope. We list them in advance in the quotation and do not charge twice for the same activity.

Dyasol works with a core team and a network of specialists. The composition depends on the task. Before the start we confirm the engagement lead, the participating specialists, their functions and their access to information. Some expert profiles are presented publicly by area of expertise; each client learns who works on their engagement.

An assessment establishes what is in place and where the gaps are. An improvement project delivers specific agreed tasks — for example rules, registers, configurations, training or processes. Monthly support provides recurring work and an agreed expert capacity. You can commission only the part you need.

Material that lets someone verify a specific action or state: approvals, test results, training records, registers and documented reviews. A policy describes the rule; the records of its execution show how it is applied. Where evidence is missing, we record the gap and the action needed. We do not present training that has not taken place or a test that was not run as done.

We cannot guarantee the decision of a regulator, auditor, bank or customer. We take responsibility for the agreed work and for the soundness of our findings. We state the scope, the sources, the gaps identified and the limitations, so that the result can be used in an inspection.

Yes, if you choose the regulatory assessment and certificate. A Dyasol certificate is also included in the annual programme, the readiness and evidence pack and delivering the DORA plan when the assessment is successful. It is a private certificate under our methodology, which strictly follows the regulatory requirements, and anyone can verify it on our website. It is not accredited certification and does not replace independent assessment or certification where applicable. Our other packages do not include a certificate: you receive the agreed analyses and documents. Dyasol can support preparation for ISO certification or a SOC 2 examination; the independent body issues the certificate or the report. SOC 2 is an attestation report, not a certificate.

Only when the quote says so explicitly. Diagnosis and a review of documentation do not automatically mean implementing every recommendation. After an assessment we can propose a separate project for specific changes, or coordinate the work of your IT team.

Yes. We offer a monthly monitoring service for the agreed domains and sending services. Depending on scope, it can cover selected SPF, DKIM and DMARC signals, blocklists, reputation and deliverability indicators, and suspicious similar domains, with alerts and a short recurring report. The sources, frequency and response times are agreed in the subscription. Monitoring cannot guarantee inbox placement, immediate delisting or discovery of every impersonating domain; remediation is included only when the plan says so.

Yes. We agree who takes decisions, who makes changes and who verifies results. That lets us use the knowledge already held about your environment and avoid duplication. The access and participants needed are agreed in advance.

A contact person, access to the agreed documents and time from the people responsible for the controls. For technical tasks we agree specific access and approvals. The timeline also depends on when this information is provided; if there is a delay or a change of scope, we agree its effect on the schedule.

Yes — in Bulgarian and English, usually remotely. The language of the deliverables, on-site meetings and the related costs are stated in the quote. Where another country’s rules apply, we also determine whether a local legal or regulatory specialist is needed.

Yes. Completing questionnaires, preparing evidence for customer audits and reviewing DORA contract clauses proposed by your financial-sector customers are available as a defined service for vendors. The number of questionnaires and the evidence set are agreed in the quote. We first confirm what the customer will accept, who approves it and by when. If a valid ISO 27001 certificate or SOC 2 report is a firm condition, a completed questionnaire and evidence pack do not replace it; an alternative works only if the customer accepts it.

Yes, through vetted partners. Dyasol sets the scope and rules, accepts the report and re-tests the fixes. Round-the-clock incident response is also provided through a partner under a separate contract, while we handle decisions and reporting.

When the workload consistently exceeds the largest tier, when the regulator expects a resident officer, or when the role carries line-management duties. External cover can bridge recruitment or a temporary absence; we tell you when the workload needs a permanent internal position.

A described base scope and a published starting price make our packages straightforward to specify and compare in a procurement file. We are not a certification body or a statutory auditor, so a tender that requires an accredited audit or attestation should specify that component separately; we can support the preparation.

Size is only part of the assessment. The sector, the specific activity, linked enterprises and the exceptions in national law all matter. Some entities are in scope regardless of size. Separately, a customer may impose contractual security requirements even when your organisation is not directly obliged under NIS2. See who is covered under NIS2. We confirm the national rules that apply to your organisation.

Checked on 12.09.2026 · Source: Directive (EU) 2022/2555 (NIS2), Bulgarian Cybersecurity Act — State Gazette 17/2026

It is not sensible to wait for a letter before assessing applicability and readiness. The formal identification of an entity, the information duties and the specific measures are separate questions. Some digital providers have their own duty to supply information to the authorities. We check what follows from your activity and the rules in force, without treating the absence of a notification as an exemption.

Checked on 12.09.2026 · Source: Bulgarian Cybersecurity Act — State Gazette 17/2026

Yes, if you provide ICT (information and communication technology) services to financial entities: they may require contractual clauses, information about your services, cooperation in incidents and evidence of security. That is different from the direct oversight of ICT providers designated as critical at EU level, which concerns a small number of large providers. We look at your role and your customers’ specific requirements.

Checked on 12.09.2026 · Source: Regulation (EU) 2022/2554 (DORA)

A certified system can cover a substantial part of the work, but it does not automatically demonstrate every applicable legal and contractual requirement: management-body approval and training, statutory reporting deadlines, supply-chain and contract terms, registration duties and, under DORA, the register of ICT arrangements and resilience testing. We start from your existing documents, controls and evidence and identify the specific additions. Nothing has to be rebuilt from scratch.

Shadow AI is the use of AI tools outside the approved or visible process of the organisation. The assessment can draw on surveys, interviews, existing records and agreed technical sources. Coverage depends on those sources and on access. We do not promise completeness where the method does not allow it; we describe what was checked and what remains unknown.

No. The AI Act applies in stages, and Regulation (EU) 2026/1744 deferred part of the high-risk obligations. Prohibited practices, AI-literacy measures, general-purpose AI obligations and applicable transparency duties remain in force on their respective dates. We determine the obligations from your role and use of AI, not merely from the fact that you use it.

Checked on 12.09.2026 · Source: European Commission — AI Act, AI Act, Art. 50 (consolidated text)

Possibly. It depends on the product, how it is supplied, the market and your role; not every SaaS model is treated the same way. Reporting duties for covered manufacturers apply from 11 September 2026 and the main product requirements from 11 December 2027. We check your product and role rather than assuming coverage.

Checked on 12.09.2026 · Source: European Commission — Cyber Resilience Act

In defined cases, yes. We first check whether external performance is permitted, which tasks and powers are needed and whether there is sufficient capacity. Not every useful function is a mandatory statutory post. The role, reporting line, time and substitution are described in the contract.

That is assessed case by case. A data protection officer must be able to monitor processing independently and without conflict with their other functions. A role that determines the purposes and means of processing — the EDPB names heads of IT among the examples — may be incompatible. Where separation is needed, we propose separate specialists.

Checked on 12.09.2026 · Source: EDPB — Data protection officer

No. The organisation’s management keeps its statutory duties and powers. Dyasol is responsible for the agreed performance. We specify which decisions you take, which tasks we perform and which actions depend on other providers.

Yes, through a vetted partner under a separate readiness retainer: a round-the-clock line, technical containment and forensics. Dyasol handles management decisions and reporting to the authorities. Our standard services run in the agreed working hours. The ordinary contact form is not a channel for urgent incidents.

We work through specific situations, for example a request to change bank details or a call from someone presenting themselves as an executive. Participants discuss how they verify the request, who decides and when escalation is needed. The result is a documented decision protocol and agreed actions. The workshop is led with both human-factors and security expertise.

Yes. Workshops on fraud-related decisions and on sustainable working practices can be commissioned separately. We agree the audience, topic, format and written output in advance. Add-on prices for another project do not automatically apply to standalone work — a standalone workshop is quoted.

As a separate, psychologist-led pilot direction for leaders and HR — on workload, boundaries, communication under pressure and the prevention of occupational burnout. It is organisational, not clinical: no diagnosis, therapy or individual profiles. See Workplace wellbeing.

The security and human-factors sessions offered on this site are organisational work. They are not clinical therapy and do not produce individual psychological profiles for the employer. Where there are interviews, we explain in advance the purpose, participation and how results are summarised.

In the existing format participation is voluntary and reports present aggregated themes. We do not provide susceptibility ratings for individuals. In a small team removing a name is not always enough, so we also consider whether a description or a quote could identify a participant. Access and storage conditions are agreed before the interviews.

We agree confidentiality, participants, the access needed and the ways information is exchanged and stored. Where we process personal data on your behalf, we put the corresponding processing arrangements in place. Any subcontractors and their roles are agreed in advance.

Yes, where that is within the agreed purpose of the deliverable. We recommend providing the version suited to the recipient: an executive summary, an evidence pack or a technical report. Vulnerabilities and sensitive details are shared only with authorised recipients.

No. You can stop after the agreed deliverable. If periodic reviews, evidence updates or an external function are needed, we offer separate monthly support with a described scope. The published notice period for ending monthly support is 30 days.

Yes. A partner can introduce us and help describe the initial need. Dyasol confirms the scope, the team and the final quote. Where a referral fee is paid, the partner relationship is disclosed to the client under the terms of the programme.

· Source: Partner programme