Cybersecurity and compliance for businesses
We identify where the company is exposed, fix what matters most first and put the rules in writing. We bring to our clients the method we use internally as an ISO/IEC 27001:2022 certified company.
- Risk analysis
- Vulnerability analysis
- Policies and procedures
- GDPR
- Staff training
When an assessment is needed
When you need to know, and prove, how well protected the company is.
A client asks for guarantees
Security questionnaires, contractual clauses, supplier qualification.
You do not know how exposed the company is
No overall assessment has ever been carried out.
An incident has already happened
A phishing attempt, a compromised account, an encrypted file.
GDPR documentation is out of date
Documents written years ago that no longer match the organisation.
What you receive
Documents useful to management, to audits and to clients.
Risk report
Readable by management as well.
Remediation plan
Actions ordered by priority.
Up-to-date documentation
Policies, procedures and registers that match the real company.
Trained staff
With reusable materials.
What we do for security
From risk analysis to written rules, through to staff training.
Risk analysis
Information assets, threats and vulnerabilities are analysed to establish the level of risk and the priorities.
Vulnerability analysis
Networks, systems, applications and Microsoft 365 and Azure configurations.
Policies and procedures
Use of tools, access and passwords, backup, incident management, suppliers.
GDPR
Record of processing activities, privacy notices, appointments, impact assessments when required, data breach procedure.
Training
Recognising phishing and scams, handling passwords and data in daily work.
Have you been asked for security guarantees?
Certificate, security policy and answers to questionnaires.
See the certificationsFrequently asked questions
What is an information security risk assessment?
An analysis that identifies information assets, threats and vulnerabilities, estimates the risk for each area and produces a plan of actions in order of priority.
How often should the risk assessment be repeated?
As good practice at least once a year, and after significant changes such as migrations, new systems or incidents.
Does GDPR require specific tools?
No. It requires technical and organisational measures appropriate to the risk, such as access control, backup and periodic checks.
Does NIS2 apply to our company?
It depends on sector, activity and size. The energy sector is among those included, and the directive was transposed in Italy by Legislative Decree 138/2024. A preliminary check clarifies whether it applies and with what obligations.
How exposed is your company?
We start from two questions: what to protect and who can access it.
Request a risk assessment