We build measurable, provable security structures for small and medium-sized businesses — from ISMS to NIS2 to the cloud. Predictable on budget, clear in the boardroom, solid in the audit.
Recommendation · Priority 1: IAM model & backup strategy
Illustrative — distilled from typical starting points.
01 — Services
No catalogue of forty offerings. We do what companies actually need to move now: structure, obligations, cloud.
An information security management system that fits your size — and ends in certification, not in the filing cabinet.
We determine what applies to you — and make you audit-ready before your customers or the regulator ask.
A secure cloud, a clean pipeline — without slowing down the delivery teams that drive your revenue.
02 — Context
Since the start of 2025 the NIS2 implementation act has been in force — and it brings more companies into scope than most realise.
Fact 01
The implementation act has applied since January 2025. The first question — are we affected at all? — is half the work. The most common mistake: not checking at all.
Fact 02
Your customers increasingly ask about security: TISAX certificates, NIS2 questionnaires, ISO references. Without evidence you risk losing the contract — regardless of what the regulation requires of you.
Fact 03
Small and medium-sized businesses are seen as soft targets — and increasingly are. Tidy security is therefore not just risk reduction here, but the fastest differentiating advantage in sales.
03 — Process
Every phase has a result you keep — even if the engagement ends afterwards.
01
We listen and look: systems landscape, processes, legal classification. Usually two weeks, remote or on site. Afterwards both sides know where you stand.
02
A prioritised list instead of a threat slideshow: what is risky, why — and what we do first. Traceable for management, team and customers.
03
We build with you, not just for you: policies, technical measures, training. In sprints that fit daily work — with clear milestones.
04
Certification or audit support — and an operating model that keeps security part of the day-to-day, without us becoming the bottleneck.
Typical time to a finished risk assessment: 4–6 weeks.
04 — Work
We only give names when it is explicitly okay. So anonymised — but with real results.
We did not even know what NIS2 meant for us. Now we have a classification, a system — and the audit under control.
For the first time someone explains security in a way the boardroom understands — and the team actually implements.
30 minutes, no obligation. You leave with an honest assessment — whether we work together afterwards is your decision.
