Cybersecurity compliance: from obligation to strategic asset
NIS2, DORA, ENS, ISO 27001. Cybersecurity regulations keep multiplying and tightening. We help you understand what applies to you, what's missing and how to get there without turning it into a never-ending project.
The problem with compliance today
Companies face a regulatory map that overlaps and contradicts itself: the NIS2 Directive covers critical sectors, DORA applies to the financial sector, the ENS applies to public entities and their suppliers, and ISO 27001 is increasingly demanded by enterprise clients as a contractual requirement. Each regulation has its own deadlines, specific controls and penalty regime. Without a guide who knows them well, the risk is investing huge effort and getting nowhere. We support compliance projects for companies across Spain — Valencia, Alicante, Seville, Barcelona and beyond — remotely, with on-site presence when the audit requires it.
Regulations we cover
- NIS2 — European directive on the security of network and information systems
- DORA — Digital Operational Resilience Act for the financial sector
- ENS — Spain's National Security Framework for the public sector
- ISO 27001 — International standard for information security management
- GDPR — Technical aspects of data protection and security measures
- PCI-DSS — Security in card payment processing
How we approach compliance
- Applicability analysis: We determine exactly which regulations apply to you, at what level and under what deadlines.
- Gap analysis: We compare your current state against the required controls. The result is a clear map of what you have and what's missing.
- Compliance plan: Action plan prioritized by risk and impact, with measurable milestones and concrete deliverables.
- Technical implementation: We support your IT team with implementation: access management, encryption, logging, backups, vulnerability management.
- Documentation and evidence: We draft the necessary policies, procedures and records: ISMS, incident procedure, business continuity plan.
- Audit readiness: We simulate the external audit, fix deviations and prepare your team to answer with confidence.
What's included
- Gap analysis report with prioritized gaps
- Compliance plan with timeline and owners
- Complete documentation package (policies and procedures)
- Support implementing technical controls
- Team training and awareness
- Support during the external audit
Who needs this service?
- Companies in sectors regulated by NIS2: energy, healthcare, transport, ICT, water, finance
- Financial and insurance entities subject to DORA
- Public administrations and their technology suppliers (ENS)
- Companies whose enterprise clients require ISO 27001
- SaaS and tech companies seeking certification to open up the enterprise market
Frequently asked questions
Can you help us with several regulations at once?
Yes, and it makes sense to do so. Many controls in ISO 27001, NIS2 and DORA overlap. Handling them in an integrated way avoids duplication and reduces overall effort.
Do you also run the certification audit?
We're not a certification body (that requires ENAC accreditation), but we work with the main certification bodies and support you throughout the process.
How long does a compliance project take?
It depends on the regulation and your starting point. A gap analysis takes 2-4 weeks. A full ISO 27001 project from scratch takes between 6 and 12 months for an SMB.
Is the ENS mandatory for private companies?
The ENS is mandatory for public administrations and private companies that provide ICT services to the administration or process publicly owned data.
Where do we start if we do not comply with anything yet?
With an assessment, not with the paperwork. First establish which regulations actually bind you and which category you fall into, then measure the real distance between what you do and what is required. Writing policies before knowing that produces folders that fail an audit and reduce no risk.
What if we are audited before the compliance work is finished?
Having a documented compliance plan, with milestones and owners, is a defensible position with a supervisor; having nothing is not. That is why the first deliverable is always the risk-prioritized plan: if the audit arrives early, you can show what is done, what is in progress and on what basis you sequenced it.
How much of what NIS2 requires also counts toward ISO 27001 or the ENS?
Considerably more than people assume. Risk management, access control, incident handling, business continuity and supplier security appear in all three frameworks with different wording and the same substance. The efficient route is to map the shared controls once and document separately only what each regulation specifically demands. Running three full frameworks in parallel multiplies cost without adding compliance.
Specialised services
- NIS2 consulting: comply with the EU cybersecurity directive
- DORA compliance: digital operational resilience for the financial sector
- ENS audit: compliance with Spain's National Security Framework (ENS)
- ISO 27001: implementing and certifying your information security management system
- Cyber Resilience Act (CRA) consulting: compliance for software and hardware manufacturers and suppliers
- AI Act compliance consulting: adapting to the EU Artificial Intelligence Regulation
- Cybersecurity compliance in Spain for international companies: NIS2, ENS, DORA and GDPR with one English-speaking provider