Service prices and scope
- A fixed price only means something if the scope is fixed too.
- You get a cap on your own spend, not an open-ended engagement.
- A 30-person company should not be paying for the complexity of a 500-person one.
- If scoping shows you are in a larger band, you hear it before you sign — never as a surprise invoice.
- Named targets — domains, entities, systems — are listed in the contract annexe, agreed in writing before the price is fixed.
| Service | What you receive | Price | Timing |
|---|---|---|---|
| Check which rules apply | A short written DORA / NIS2 applicability conclusion, its basis and the next actions. | from €900 | 3–5 working days |
| Respond to a customer questionnaire | Draft answers, organised evidence and a list of missing items. | from €1 300 | Usually 5–15 working days |
| Make a specific technical improvement | Investigate the problem and deliver agreed corrections, followed by verification. | By written quotation | Timeline after scoping |
| NIS2 quick assessment | A preliminary status for each NIS2 measure, the main risks identified and a 90-day plan, based on interviews and key documents. | from €2 900 | 10 working days |
| DORA / NIS2 assessment and evidence | Get a gap assessment, a review of the agreed documents and an organised record of available evidence, with missing items and next actions clearly identified. | from €7 900 | 3–5 weeks; DORA: 3–6 weeks |
| Business email and domain review | Get an assessment of the agreed domains and signals, prioritised actions and a report your team can use. | from €2 400 | 5–10 business days |
| AI use review | Get an inventory of identified uses, a risk register and rules for acceptable use and approval. | from €5 900 | 3–4 weeks |
| Bank supplier pack | DORA contract-clause review, draft answers to the bank’s questionnaire and a reusable evidence index. | €3 900 | Usually 2–3 weeks |
| DORA register diagnostic | Error report and correction plan. Corrections and submission are quoted separately. | €2 600 | About 5 working days |
| Delivering the DORA plan | From the assessment to implemented measures and documented evidence. | from €9 900 | Depending on scope |
| Annual compliance programme | A DORA or NIS2 assessment plus 12 months of an external expert role (8 hours a month): plan, registers, evidence and reports to management. One contract for the year. | €24 700 | 12 months |
| External expert roles | A designated specialist takes on agreed functions — vCISO, compliance lead and other roles. | from €1 400 / month | Monthly plan |
| Email and domain monitoring | Recurring checks of the agreed domains and sending services, selected authentication, blocklist, reputation and deliverability signals, with alerts and a concise report at the agreed frequency. | By written quotation | Monthly subscription |
| Recovery testing and continuity planning | A controlled restore test of an important system with measured time; the continuity plan is quoted separately. | from €1 900 | Usually 1–2 weeks |
| Microsoft 365 and account security | A review of rights, sign-in, sharing, mail rules and logging; improvements quoted separately. | from €1 900 | Usually 1–2 weeks |
| Regulatory assessment and certificate | An assessment of your measures against NIS2 or DORA and a Dyasol certificate that anyone can verify. | from €4 900 | Usually 3–6 weeks |
| Information system acceptance check | A check of what was contracted, access, security, backup and data export before acceptance is signed. | from €2 400 | Usually 2–3 weeks |
| Whistleblowing channel | Internal rules, written and oral channels, forms, a register and training for the responsible staff. | from €1 900 | Usually 2–3 weeks |
| GDPR audit and DPIA | A GDPR compliance audit; an impact assessment for processing likely to result in a high risk from €1 900. | from €2 900 | Usually 2–3 weeks |
| ISO 27001 certification readiness | A gap analysis against ISO/IEC 27001:2022 and a plan to the certification audit; the programme to certification is quoted separately. | from €4 900 | Usually 2–3 weeks |
| Supplier and third-party risk | Up to 20 suppliers: register, tiers, questionnaire, contract checks for critical ones and an onboarding procedure. | from €3 900 | Usually 3–4 weeks |
| Annual internal cybersecurity audit | An independent internal audit against NIS2 measures and ISO 27001, with a report and remediation deadlines. | from €3 900 | Usually 2–3 weeks |
| Cyber incident exercise | A tabletop exercise on a scenario from your environment, with a written record and an improvement plan. | from €1 900 | Half a day |
| Cyber Resilience Act (CRA) | Reporting readiness for vulnerabilities and incidents (applies since 11 Sep 2026) and a product assessment ahead of December 2027. | from €2 400 | Usually 1–2 weeks |
| 24/7 incident response (via partner) | A readiness retainer: round-the-clock line, containment and forensics from a partner; decisions and reporting with Dyasol. | By written quotation | Annual retainer |
| Penetration testing (via partner) | Web, API, network and cloud, vulnerability scanning and re-testing of fixes. | By written quotation | Depending on scope |
| Online staff training (via partner) | Courses with completion tracking and a report for management. | By written quotation | Per employee |
| Cybersecurity training | The management training NIS2 requires (half a day, written record and certificates) and role-based staff training. | from €1 400 | Half a day |
| Business psychology and cyberpsychology | A fraud-decision workshop, an analysis of staff AI use and follow-up exercises. | By written quotation | Depending on format |
| Workplace wellbeing | A separate service for leaders and HR, with a practical action plan. | By written quotation | Depending on format |
| Service | Included in the base scope | Beyond the base scope — confirmed extras |
|---|---|---|
| Business email and domain review from €2 400 |
|
|
| DORA / NIS2 readiness and evidence pack from €7 900 |
|
|
| AI use and governance review from €5 900 |
|
|
A customer request may need a written applicability assessment, a questionnaire response or one technical correction. Each can be commissioned separately. The combined DORA budget applies only if you commission both the assessment and implementation.
Written applicability from €900 · Customer questionnaire · Register diagnostic €2 600 · Focused improvement
DORA / NIS2 applicability note — from €900 →
For pricing, employee counts are the average headcount over the last 12 months within the agreed scope. This is a commercial service limit, not a method of deciding DORA or NIS2 applicability; regulatory size and group criteria are assessed separately.
A minimum price reflects preparation, evidence review and professional checking. Headcount is one scope limit; it does not measure all the work. Systems, contracts, existing records and unresolved questions also affect effort.
Contract review and processing an ICT arrangement in the register are separate activities. If both are required beyond the included limits, the quotation lists each additional fee separately.
A larger scope is one quotation, not stacked add-ons. The extra for a second entity applies to shared systems, policies and governance — a genuinely separate environment is quoted individually. Limits do not multiply automatically; the from €13 900 figure is the starting price for the expanded project as a whole; its scope is described in one quotation.
At the walkthrough, review outputs, sources, usable files and unknowns. You have ten working days for specific comments and one included clarification round. Defects in our agreed work are corrected without extra charge, including when discovered later; the review window does not waive those rights. Silence is not final acceptance. New facts or requirements are distinguished before quoting additional work. Specific terms are included in the agreement.
BoundariesNot included
- Implementing the remediation — that is quoted separately as a fixed-scope project
- 24/7 cover or emergency incident-response hours
- Unlimited security-questionnaire answering
- Certification, statutory audit or legal opinions — these are performed by certification bodies, registered auditors and lawyers respectively
Monthly support has a defined allowance
Monthly support includes an agreed allowance of senior time, not unlimited availability. We publish it so that you can compare the service clearly.
A monthly engagement includes a planned allowance, the agreed response window and the published rollover terms. An individually booked day is a scheduled piece of work and does not by itself establish ongoing response availability. Named substitute arrangements must be confirmed in the agreement.
| Monthly option | Per month | Included |
|---|---|---|
| 1 day per month | €1 400 | 8 hours of senior work |
| 2 days per month | €2 600 | 16 hours of senior work |
| 4 days per month | €4 900 | 32 hours of senior work |
| Published day rate | €1 300 |
One expert day is eight hours of senior time, usable in parts — preparation, analysis, meetings, written responses and agreed coordination all count towards it. There is no unlimited work between meetings.
Outside the agreed service window, the standard retainer provides no committed immediate response or technical containment. Use your organisation’s arranged incident route. The agreement defines hours, time zone and escalation; a meeting in another time zone does not extend the window.
Compare the responsibilities, not just the hours. An IT provider may already perform some security tasks. We identify what is covered, what remains with management and where extra leadership or independent review is useful. If recurring work exceeds the agreed capacity, we discuss a larger allowance or an internal role. Compare cost and responsibilities →
These tiers cover ongoing senior work in security and ICT risk governance. DPO (data protection officer) and other specialist functions are scoped and priced separately according to the capacity and independence required.
- Unused time rolls over for one month, up to half of that month’s allowance; carried-over time is used first and expires at the end of that next month.
- Before additional days are used, we confirm in writing whether they remain a one-off day or whether a larger monthly option applies, and from which month. Where the larger option costs less for the requested capacity, we propose it.
- Response to a critical issue within 4 working hours during the agreed service window means acknowledgement and first guidance, not resolution of the incident; one business day otherwise. The service window, contact channel and a named substitute are set in the contract.
- No 24/7 promise in the standard service. Where you need round-the-clock cover, we arrange it separately with a vetted partner once availability is confirmed. Who receives an incident alert, when, and what Dyasol does is set out under incident help.
- Monthly subscriptions: 30 days’ notice to cancel, at any time. Annual programme terms are set out in the proposal.
Specimens and preparation for commissioning
These specimens and worksheets show how outputs, your participation and acceptance are recorded. Specific terms are completed and agreed for the engagement.