Risk Reduction During Audits & NIS2 Readiness
We are accountable for the quality of our work. We put our guarantees in the contract and work under strict NDAs.
NIS2 / KSC · ISO 27001 · Client security questionnaires · RODO · PCI DSS
Which audits we help you pass
Pick your situation or write to us: we will tell you where to start.
- 01
Passing an NIS2 audit (KSC Act)
What it isThe EU cybersecurity directive (NIS2). In Poland its requirements are set out in the KSC Act, which covers the protection of IT systems, critical infrastructure and supply chains.
Who needs itMedium and large companies in essential and important sectors: energy, transport, IT services, logistics, manufacturing, digital infrastructure. Whether the act applies to you depends on your sector and company size.
ResultReduce the risk of fines of up to €10M and of personal liability for management.
We find the technical gaps in advance and show how to close them before the regulator's audit. The measures must be in place by April 3, 2027.
- 02
Passing ISO 27001 certification
What it isThe international standard for information security management, ISMS (SZBI in Polish). The certificate confirms that the company has a system for protecting information built to the standard's requirements.
Who needs itIT companies, startups and SaaS services that are moving toward large corporate clients or working with investors.
ResultGet your infrastructure ready for certification and reduce the risk of being sent back for rework.
We work through the technical side of the requirements and collect evidence in advance, so you do not spend budget on repeat audits.
- 03
Passing client and partner checks
What it isWhen a B2B client sends a long security questionnaire before signing or renewing a contract.
Who needs itB2B companies, vendors and contractors whose large customers require proof of data protection.
ResultProtect your deals: answer the client quickly and with evidence.
We help you prepare honest answers backed by technical evidence, so the deal is not held up by security questions.
- 04
RODO/GDPR technical requirements
What it isThe European regulation on personal data protection (RODO in Poland). It sets out how a company stores, processes and protects client and employee data.
Who needs itAny business in the EU that processes personal data: accounts, client databases, HR data.
ResultReduce the risk of data leaks and UODO fines.
We check the technical side: where data is stored, who has access to it, how backups and logs are protected. This does not replace a legal opinion.
- 05
Security policies and rules
What it isA set of internal documents that define access, incident response and rules for employees.
Who needs itCompanies whose auditors, partners or investors have asked for information security procedures.
ResultGet a ready set of documents you can show to an auditor or a major client.
We prepare access rules, incident response plans, backup schemes and AI usage rules for employees.
- 06
Passing a PCI DSS audit
What it isThe international security standard for payment card data. Payment networks and banks require it from companies that process, store or transmit card data.
Who needs itOnline stores, fintech projects, booking services and other companies that accept online payments.
ResultReduce the risk of being blocked or fined by payment networks.
We check the technical side of the requirements and find the gaps before the official audit.
NIS2 (KSC Act in Poland) Readiness
- Implement mandatory technical and organizational measures before regulator deadlines (April 2027)
- Reduce the risk of personal financial and operational liability for management
Client Questionnaires & ISO 27001
- Assistance with enterprise client security questionnaires (Vendor Assessment)
- Gap analysis and full preparation for ISO 27001 and PCI DSS technical requirements
The KSC Act is already in force
- 3 Apr 2026the act came into force
- 3 Oct 2026applications to the KSC list of entities
- 3 Apr 2027implement an ISMS (SZBI) and procedures
- 3 Apr 2028first audit for essential entities
What is at stake
- €10M
or 2% of revenue for essential entities; up to €7M or 1.4% for important ones
- PLN 100M
in serious cases
- 300%
of their pay, which a manager may have to pay personally.
Five steps of preparation
- Step 1Quick consultation
We find out which audit you are facing, who is conducting it and by what date.
- Step 2Gap assessment
We compare the requirements with what you already have and show what is missing.
- Step 3Gap closure plan
What to fix, in what order, and how much time and budget it will take.
- Step 4Documents and evidence
We prepare policies and collect evidence and questionnaire answers.
- Step 5Support up to the audit
Optional: we answer questions and help with evidence up to the day of the audit.
What you will have in hand
- Gap report against the requirements, with priorities
- Gap closure roadmap: what to fix, in what order, who is responsible, how much time and budget it will take before the audit date (for NIS2, by April 3, 2027)
- Package of documents and policies
- Ready answers to the client security questionnaire, with evidence
- critical
- critical
- high
- high
- medium
What companies come to us with
A client sent a security questionnaire, and you have no answers or evidence
Put together honest answers, back them up with settings and documents, and close the gaps before sending.
You have heard about NIS2 but are not sure whether it applies to your company
Take a self-check and, if needed, assess the technical gaps and draw up a plan.
You lack evidence for ISO 27001 certification
Collect logs, access lists and evidence against the standard's requirements in advance.
Generalized examples of typical situations, not stories of specific clients.
Included in packages
All packagesNo. A formal audit and certification are carried out by an auditor or a certification body. We prepare you for them and reduce the risks along the way.