05 — Compliance
Compliance & Regulatory Frameworks
Many organizations approach ISO 27001 or ENS starting with documentation. Everything looks correct on paper. When the audit arrives, the problems surface in the architecture. Flat networks, weak identity controls, missing logging. Regulatory frameworks rarely fail because of missing policies. They fail because the architecture was never designed with security in mind.
The Problem
Many organizations approach ISO 27001, ENS or NIS2 starting with documentation.
Policies, procedures and records are written, and everything looks correct on paper. When the audit arrives, the problems appear in the architecture: flat networks, weak identity controls, incomplete logging, or controls that exist in documents but not in the actual systems.
The result is often the same: compensating controls added on top of an architecture that was never designed to meet the requirements in the first place.
Our Approach
We start from the technical architecture rather than from the control checklist.
We assess the real state of the infrastructure: how the network is segmented, how identity is governed, what visibility exists over events and access, and which controls actually work.
Our objective is to align the architecture with the regulatory framework. Compliance built on solid architecture withstands audits. Compliance based only on documentation does not.
Capabilities
- ISO 27001 gap analysis
- ENS2 (Spanish National Security Framework) technical readiness
- NIS2 technical compliance
- Design of controls aligned with regulatory frameworks
- Security governance and risk management
- Support throughout the certification process
Typical Scenarios
- Technical gap analysis for ISO 27001 based on real control implementation
- Architecture and evidence preparation for ENS audits
- Technical alignment with NIS2 requirements (segmentation, logging, incident management)
- DORA-aligned technical control design for financial institutions
- Certification process support as independent technical judgement
Do you recognise any of these challenges?
If the challenge fits our profile, we'll tell you. If not, we'll say that too. We always start with a no-commitment technical conversation.
Start a conversation