From obligations to effective processes
Information security governance, ISO/IEC 27001 and regulation
Compliance is not a product. It requires risk assessment, process ownership, technical safeguards, review and evidence, while retaining effective controls already in place.
NIS2, GDPR, ISO/IEC 27001 and DORA, where applicable, establish different sets of requirements. No software replaces an understanding of the organisation. Before selecting tools, we examine what applies, how the organisation operates, who owns decisions and how safeguards can be evidenced.
When to involve us
- You need to align risks, procedures and safeguards with ISO/IEC 27001:2022 or applicable NIS2 requirements.
- Privacy, information security and incident handling processes need clearer accountability and practical procedures.
- You operate in a sector subject to DORA and need to align ICT measures with business processes.
- Controls are already in place but evidence, ownership or documentation is inconsistent.
What we can contribute
- Define scope and review operations, systems, critical services and suppliers.
- Analyse risks and map applicable requirements against current processes and safeguards.
- Support policies, responsibilities, incident procedures and continuity arrangements.
- Review technical implementation and evidence, then prioritise the gaps and improvements.
What the engagement delivers
The agreed scope may deliver a gap analysis, risk-control-responsibility mapping, technical evidence and a treatment or improvement roadmap. Deliverables are not certifications or guarantees of regulatory compliance.
How we collaborate
Braintec’s founder personally holds an ISO/IEC 27001:2022 Lead Auditor qualification; Braintec itself is not certified by that qualification. We work with process owners, privacy and legal specialists, IT staff and auditors, keeping consulting and independent auditing roles appropriately separate.
Next steps
We start with the actual environment, objectives and constraints. The initial discussion helps establish whether and where specialist input adds value.
Discuss risk and governance Try the preliminary NIS2 self-assessment