Compliance and advisory
Independent help to understand your obligations under NIS2, DORA and GDPR, and to prepare for ISO/IEC 27001. We advise and carry out internal audits; we never certify.
Why we do not certify
Cyberuptive Europe is not a certification body and does not certify clients. This is a deliberate choice: certification bodies may not certify organisations they have advised, and we would rather advise.
When you are ready, we help you prepare for an accredited certification body of your choosing.
Who it is for
- Essential and important entities under NIS2 and Portugal's Decreto-Lei n.º 125/2025.
- Financial entities preparing for, or subject to, DORA.
- Organisations that must show security appropriate to the risk under GDPR Article 32.
- Organisations preparing for ISO/IEC 27001 certification.
- Makers of products with digital elements preparing for the Cyber Resilience Act.
What is included
Readiness assessment
A clear view of which requirements apply to you, where you stand against them, and a prioritised plan.
Implementation support
Policies, procedures, risk assessment and controls, written to fit how your organisation actually works.
Internal audit
Independent internal audits, including ISO/IEC 27001 internal audit, with findings you can act on.
Management briefings
NIS2 makes management bodies responsible for approving and overseeing cybersecurity measures, and requires them to follow training. We help them understand what they are approving.
How engagements start
A first conversation
We discuss your sector, your size and the obligations you believe apply.
Scoping
We confirm which regulations and standards are in scope, and agree what we will deliver.
Assessment
We review your current position through interviews, documents and evidence.
Plan and support
You receive a prioritised plan, and we support its implementation as far as you need.
Regulations it supports
- NIS2
- Scope, risk management measures, incident reporting and management accountability, including under Portugal's Decreto-Lei n.º 125/2025.
- DORA
- ICT risk management, incident management and reporting, resilience testing and ICT third-party risk.
- GDPR
- Security of processing under Article 32, and breach notification readiness under Articles 33 and 34.
- ISO/IEC 27001
- Readiness for certification, implementation of the management system, and internal audit.
- Cyber Resilience Act
- Understanding the essential requirements and vulnerability handling duties for products with digital elements.
Unsure which obligations apply?
Tell us about your organisation and sector. We will help you work out what is in scope before you commit to anything.
Arrange a conversation