Services for your situation
Choose a specific first task, a broader assessment or an external expert role. Scope and price are confirmed in writing before work starts.
What do you need?
Pick the situation closest to yours. Prices are starting prices; scope and price are confirmed in writing before work starts.
We do not know what is required of us
You get a clear answer on which rules apply and where to start.
- NIS2 self-checkfree
- Written applicability assessmentfrom €900
- Quick assessment in 10 working daysfrom €2 900
A review, audit or certification is coming
You go into the review with organised evidence and clear priorities.
- NIS2 or DORA readiness and evidence packfrom €7 900
- Annual internal auditfrom €3 900
- ISO 27001 certification readinessfrom €4 900
- Regulatory assessment and Dyasol certificatefrom €4 900
A customer or bank wants evidence
You move through the customer’s approval with substantiated answers and evidence.
- Security questionnaire responsefrom €1 300
- Bank supplier pack€3 900
- DORA register diagnostic€2 600
Practical protection and checking the measures
Reviews and tests show what to change; implementing the changes is quoted separately.
- Implementing agreed improvementsby quotation
- Microsoft 365 and accountsfrom €1 900 for the review
- Recovery after an outagefrom €1 900 for the test
- Supplier riskfrom €3 900 for the assessment
- Delivering the DORA planfrom €9 900
We need an expert on an ongoing basis
Someone moves security and compliance forward every month without a full-time hire.
- External expert role (vCISO and others)from €1 400 / month
- Annual programme: assessment plus 12 months€24 700
- 24/7 incident response via partnerby quotation
- Penetration testing via partnerby quotation
Training and exercises
Management and teams know what to do before something happens.
- Management trainingfrom €1 400
- Cyber incident exercisefrom €1 900
- Fraud-decision workshop€900 as a module
- Online staff trainingby quotation
A specific topic or regulation
You meet the specific obligation with clear rules and documents.
- AI Actfrom €5 900
- Cyber Resilience Act (CRA)from €2 400
- GDPR audit and impact assessment (DPIA)from €1 900
- Whistleblowing channelfrom €1 900
- Email and domain: spam and impersonationfrom €2 400
Municipality or public body
The administration meets the law with a plan, owners and a budget it can justify.
- Management trainingfrom €1 400
- Quick assessmentfrom €2 900
- Information system acceptancefrom €2 400 for the check
- Public-sector programmeby quotation
Want to compare all services? The full table is below. To the table ↓
Where to start by organisation
A guide by size and type of organisation. The exact scope and price are confirmed in writing before work starts.
| Organisation | Good starting point |
|---|---|
| Small company (up to 50 people) supplying banks, hospitals or public bodiesA customer wants a questionnaire or evidence |
|
| Medium organisation (50–100 people) in a NIS2 sectorThe law applies; you need a plan and evidence |
|
| Larger organisation (101–500 people) or two regulationsMore units, systems and contracts |
|
| Financial entityDORA requirements |
|
| IT supplier to a bankThe bank wants clauses, answers and evidence |
|
| Over 500 people or a group of companiesScope is set case by case |
|
Compare all services — full table
| Service | What you receive | Price | Timing |
|---|---|---|---|
| Check which rules apply | A short written DORA / NIS2 applicability conclusion, its basis and the next actions. | from €900 | 3–5 working days |
| Respond to a customer questionnaire | Draft answers, organised evidence and a list of missing items. | from €1 300 | Usually 5–15 working days |
| Make a specific technical improvement | Investigate the problem and deliver agreed corrections, followed by verification. | By written quotation | Timeline after scoping |
| NIS2 quick assessment | A preliminary status for each NIS2 measure, the main risks identified and a 90-day plan, based on interviews and key documents. | from €2 900 | 10 working days |
| DORA / NIS2 assessment and evidence | Get a gap assessment, a review of the agreed documents and an organised record of available evidence, with missing items and next actions clearly identified. | from €7 900 | 3–5 weeks; DORA: 3–6 weeks |
| Business email and domain review | Get an assessment of the agreed domains and signals, prioritised actions and a report your team can use. | from €2 400 | 5–10 business days |
| AI use review | Get an inventory of identified uses, a risk register and rules for acceptable use and approval. | from €5 900 | 3–4 weeks |
| Bank supplier pack | DORA contract-clause review, draft answers to the bank’s questionnaire and a reusable evidence index. | €3 900 | Usually 2–3 weeks |
| DORA register diagnostic | Error report and correction plan. Corrections and submission are quoted separately. | €2 600 | About 5 working days |
| Delivering the DORA plan | From the assessment to implemented measures and documented evidence. | from €9 900 | Depending on scope |
| Annual compliance programme | A DORA or NIS2 assessment plus 12 months of an external expert role (8 hours a month): plan, registers, evidence and reports to management. One contract for the year. | €24 700 | 12 months |
| External expert roles | A designated specialist takes on agreed functions — vCISO, compliance lead and other roles. | from €1 400 / month | Monthly plan |
| Email and domain monitoring | Recurring checks of the agreed domains and sending services, selected authentication, blocklist, reputation and deliverability signals, with alerts and a concise report at the agreed frequency. | By written quotation | Monthly subscription |
| Recovery testing and continuity planning | A controlled restore test of an important system with measured time; the continuity plan is quoted separately. | from €1 900 | Usually 1–2 weeks |
| Microsoft 365 and account security | A review of rights, sign-in, sharing, mail rules and logging; improvements quoted separately. | from €1 900 | Usually 1–2 weeks |
| Regulatory assessment and certificate | An assessment of your measures against NIS2 or DORA and a Dyasol certificate that anyone can verify. | from €4 900 | Usually 3–6 weeks |
| Information system acceptance check | A check of what was contracted, access, security, backup and data export before acceptance is signed. | from €2 400 | Usually 2–3 weeks |
| Whistleblowing channel | Internal rules, written and oral channels, forms, a register and training for the responsible staff. | from €1 900 | Usually 2–3 weeks |
| GDPR audit and DPIA | A GDPR compliance audit; an impact assessment for processing likely to result in a high risk from €1 900. | from €2 900 | Usually 2–3 weeks |
| ISO 27001 certification readiness | A gap analysis against ISO/IEC 27001:2022 and a plan to the certification audit; the programme to certification is quoted separately. | from €4 900 | Usually 2–3 weeks |
| Supplier and third-party risk | Up to 20 suppliers: register, tiers, questionnaire, contract checks for critical ones and an onboarding procedure. | from €3 900 | Usually 3–4 weeks |
| Annual internal cybersecurity audit | An independent internal audit against NIS2 measures and ISO 27001, with a report and remediation deadlines. | from €3 900 | Usually 2–3 weeks |
| Cyber incident exercise | A tabletop exercise on a scenario from your environment, with a written record and an improvement plan. | from €1 900 | Half a day |
| Cyber Resilience Act (CRA) | Reporting readiness for vulnerabilities and incidents (applies since 11 Sep 2026) and a product assessment ahead of December 2027. | from €2 400 | Usually 1–2 weeks |
| 24/7 incident response (via partner) | A readiness retainer: round-the-clock line, containment and forensics from a partner; decisions and reporting with Dyasol. | By written quotation | Annual retainer |
| Penetration testing (via partner) | Web, API, network and cloud, vulnerability scanning and re-testing of fixes. | By written quotation | Depending on scope |
| Online staff training (via partner) | Courses with completion tracking and a report for management. | By written quotation | Per employee |
| Cybersecurity training | The management training NIS2 requires (half a day, written record and certificates) and role-based staff training. | from €1 400 | Half a day |
| Business psychology and cyberpsychology | A fraud-decision workshop, an analysis of staff AI use and follow-up exercises. | By written quotation | Depending on format |
| Workplace wellbeing | A separate service for leaders and HR, with a practical action plan. | By written quotation | Depending on format |
Who we work with
Regulation does not stop at financial organisations. We work with ICT (information and communication technology) and managed service providers, organisations in NIS2 (EU cybersecurity directive) sectors, companies using AI, non-EU companies serving EU customers and municipalities. For each we clarify the applicable rules and the work already covered by your IT team.
Specialist expertise — by quotation
- Regulatory and compliance advisory
- DORA (EU Digital Operational Resilience Act), NIS2, the EU AI Act, the Cyber Resilience Act, GDPR (General Data Protection Regulation) and MiCA: gap assessments, priority plans, supplier-contract review, Register of Information preparation, third-party risk programmes.
- Certification and attestation readiness
- ISO/IEC 27001, ISO/IEC 42001 and SOC 2 — control design, policy sets and evidence discipline before an auditor is engaged. The certification body stays independent, as it must.
- Email, domain and impersonation protection
- Analysis and agreed improvements to SPF, DKIM, DMARC, sending configuration, domain reputation and impersonation exposure. Delisting and inbox placement remain outside our control.
- Security questionnaires and vendor due diligence
- A recurring task for suppliers selling to regulated organisations. We prepare the responses and organise reusable supporting evidence.
- Product, cloud and DevSecOps security
- Architecture, access, secrets, cloud configuration, CI/CD, infrastructure as code, secure development practices and readiness for customer or audit scrutiny.
- AI security and governance
- Shadow-AI discovery, AI inventories and governance, ISO/IEC 42001 gap analysis, and risk review of AI agents and their connectors.
- Fractional security leadership
- Designated, accountable security leadership in clear monthly tiers; responsibility and independence are agreed for each engagement.
- Incident readiness and exercises
- Plans, roles, reporting templates and tabletop exercises for management and technical teams. Round-the-clock response and forensics are provided through a vetted partner under a separate contract.
EU law first, national law where it applies. EU regulations such as DORA, the AI Act and the GDPR apply directly in every Member State. Directives such as NIS2 are transposed into national law, so scope details, authorities, reporting channels and deadlines depend on the Member State where you are established or operate. Examples on this site often use Bulgarian law; in each engagement we confirm the national law that applies to you and involve local counsel where needed.
A customer has sent a questionnaire? Start with the response guide and Excel workbook. If the uncertainty is legal scope, the NIS2 applicability guide shows which facts to collect. For recurring work, see Compliance-as-a-Service: monthly compliance support. For a rejected register, see DORA register validation and correction.
What to prepare for the first conversation
Describe the actual activity and licence, size and ownership information, and the request with its deadline. “40 employees” and “a services company” are not enough to decide. See how applicability is assessed.