- Target maturity
- Red flags
- Impact on valuation and deal terms
- 100-day plan
Services
Scope, deliverables and duration are agreed before work starts. I work remotely. Fixed fees, quoted on request.
Fundraising, exits and board oversight
- Your security reviewed the way a buyer would review it
- Red flags fixed before the deal
- Security documents for the data room
- Cyber and AI risk for executives and directors
- Meeting preparation
- Directors’ duties under NIS2, DORA and the AI Act
DORA for small financial entities
Asset managers, advisers, crypto-asset service providers, fintechs · fixed fee
- DORA gap assessment
- Simplified ICT risk management framework
- Regulatory register of information
- Testing plan
EU regulation
EU compliance for non-EU vendors
For software vendors and service providers based outside the EU · fixed fee, about 3 weeks
- Which EU rules reach you: GDPR, NIS2, DORA, AI Act
- Gaps against what European customers ask for
- Reusable answers for questionnaires and contract clauses
AI governance: the EU AI Act and ISO 42001
Fixed fee · also for companies outside the EU
- AI system inventory
- EU AI Act risk classification
- AI policy
- ISO 42001 gap assessment
Enterprise customer requirements
- For companies asked for certification by an enterprise customer
- Gap assessment and a 6 to 9 month plan
- Choice of GRC tool and auditor (Drata partnership disclosed)
- Full budget
ISO 27001 internal audit (mock audit)
By a certified Lead Auditor · fixed fee, 2 to 3 weeks
- Before your certification or surveillance audit
- Findings graded the way a certification body would
- Corrective action plan
- No certification audits, to stay impartial
- Steering committees
- Evidence review
- Audit preparation
- Customer security questionnaires
Budget estimate
Estimate your budget
Five questions about your needs and your organisation: you receive by email a price range for each service you select. The price of an engagement depends mainly on its scope, the size of the organisation and the complexity of its IT environment.
Indicative pricing: the estimate is neither a quote nor a commercial proposal. A commercial proposal, with the scope, deliverables and firm price, will be sent to you after an initial conversation.
Step 1 of 6