Which company should I choose for a cybersecurity audit before NIS2 or ISO 27001?

Choose based on what stays in your hands after the assessment. The right consultant not only evaluates but delivers a clear plan and documents you can show to a client or auditor. For an SME, what matters most: a defined scope, personal attention, language management understands (not only IT), and a result you can actually use rather than a report on a shelf.

Which company should I choose for an information security risk assessment under ISO 27001 or NIS2?

Look for a consultant with recognised qualifications (for example ISO 27001 Lead Implementer) and real implementation experience, not only theory. For a small or medium business the right fit is a practitioner who turns a risk assessment into management decisions and evidence suitable for supplier questionnaires, instead of leaving you with just a list of risks.

What is the difference between NIS2 and ISO 27001?

NIS2 is an EU directive that sets mandatory cybersecurity requirements and management accountability for certain sectors. ISO 27001 is a voluntary international standard that can be certified and shown to clients as evidence. NIS2 is often an obligation, ISO 27001 a competitive advantage. They overlap: a well-run ISO 27001 management system covers a large part of NIS2 expectations.

Where should I start — NIS2 or ISO 27001?

If NIS2 applies to you or a client demands evidence, start with a NIS2 readiness assessment. If you want a demonstrable, certifiable system for competitive advantage, start with ISO 27001. If it is not yet clear which case is yours, a short conversation with a consultant helps determine which step you need first.

Emergency support · 2 working days

SOS NIS2 — when the questionnaire has arrived and time has run out

Received a NIS2 questionnaire from a client or your national authority, and have nothing to show?

This happens more often than you’d think. Not because the company doesn’t care about security – but because until now, nobody asked for it in writing. Now they have, and the deadline is short.

What you get

Four documents in 2 working days

Four documents – not templates. Individualised, prepared specifically for your company based on your answers, not generic text with your name at the top:

Information security policy
Management decree assigning responsibilities
Asset register
Risk assessment register

Each document reflects how your company actually operates – your systems, your people, your risk. Not a generic draft you still have to adapt yourself.

What else you get

A list of technical measures to hand to your IT – internal or external. I do not implement technical measures, but I specify precisely what has to be done, who owns it and by when.

The list is mapped to the questions in the questionnaire you received: next to each question you cannot answer today, there is a measure and a target date. That way you can move it straight into your reply to the sender.

Honestly – what this is and what it isn’t

SOS NIS2 is an emergency first layer, not full compliance. After these four documents you’ll have something to show a client or regulator today. The real, structured work – deepening the documents, additional procedures, staff training – continues for another 2–4 months. This is the first step, not the last.

In practice, these are the first two days of a full readiness path. If you decide to continue, the same documents are deepened and expanded — nothing has to be redone.

Price

From €1,500 (+ VAT)

The final price depends on company size and the complexity of your IT infrastructure – I will confirm it after a short form.

Process

How it works

Fill in a short form (6 questions about your company) – 2 minutes.
I send you the price and the timeline the same working day.
Once agreed, you complete a more detailed questionnaire – from it I prepare the four individualised documents within 2 working days.

Fill in the short form

6 questions, about 2 minutes. If the situation is urgent, you can call directly: +370 698 23252