Security and compliance audit
Get a clearer picture of where you stand and what to do next
We make IT security easier to understand: we show you what works, what can be improved and what the real priorities are.
When you need an audit
You don’t usually get to an audit out of curiosity. It tends to happen when:
- You need to comply with requirements such as NIS2, DORA, BNR, ASF, ANAF or ADR
- You want an independent assessment, from the outside, not from within the team
- A client or partner asks you for evidence of security controls
- You are preparing an IT or digitalisation project and want it done right
- You want to check the gap between where you think you stand and where you actually stand
- You are preparing for an external audit, a certification or an official inspection
- You have an acquisition, a merger or a major change in the company
What a security
audit really is
An audit isn’t just a set of technical checks. It’s a complete picture of how your organisation protects its systems and data, and how well prepared it is for real business and regulatory requirements.
We look at:
IT infrastructure
Servers, networks, applications, databases
Technical controls
access, authentication, data protection, monitoring
Internal processes
Internal rules and processes
Responsibilities
How responsibilities are defined
Protection and continuity
The level of protection and continuity in the event of an incident
What types of requirements we cover
We tailor the audit to what applies to your organisation.
NIS2
For organisations in essential or important sectors (energy, IT, healthcare, transport, utilities, etc.), we check whether you are aligned with European and national requirements.
ADR
For regulated digital services (electronic archiving, alternative transport, video identification, etc.).
BNR
For banks and non-bank lenders, we assess the security of systems and how IT risks are managed.
ASF
For insurers and brokers, we analyse security controls and operational risks.
DORA
For banks and the financial sector, we look at digital resilience, operational risk and incident response capability.
ANAF / Order 146/2022
For organisations that need to demonstrate documented security controls.
ISAE 3402 / client requirements
For IT or outsourced service providers that need to prove their level of internal control.
Funded projects
For digitalisation projects with European or national funding, where you need technical validation.
What an audit includes
It depends on the context, but in general it covers:
- How the IT infrastructure is built
- How well security measures are implemented
- How internal rules are defined and applied
- Whether systems are configured correctly
- How well you are aligned with the applicable requirements
- What doesn’t work or is missing
- What is worth prioritising first
In the end, you don’t just get a list of problems, but a clear picture + concrete direction.
Types of audit
Security audit
Assesses the level of protection of systems, infrastructure and data and identifies vulnerabilities or risks that may affect information security.
Compliance audit
Checks the extent to which the organisation complies with the legal, normative and regulatory requirements applicable to its activity and highlights any non-conformities.
Gap analysis
Analyses the differences between the organisation’s current situation and the targeted requirements or level of compliance, to identify what needs to be improved to achieve the set objectives.
Who we work for
We work in particular with:
Financial sector
Banks, non-bank lenders, financial institutions and payment service providers.
Insurance
Insurance companies, reinsurers and insurance brokers.
Critical infrastructure
Organisations in energy, transport, healthcare, utilities, telecommunications and other essential services.
Digital services
Digital service providers, online platforms, SaaS companies and IT infrastructure operators.
Public sector
Public institutions, central and local authorities and public administration organisations.
Industry and manufacturing
Manufacturing, logistics and retail companies and other organisations with critical operational infrastructure.
How we work
The process is easy to follow:
What you get at the end
- Structured audit report
- Clearly explained findings
- Assessment of existing controls
- Relevant non-conformities and risks
- Actionable recommendations
- Prioritised actions
- Management summary
- Remediation action plan
Concrete results
Why work with us?
Official certification
We are a certified cybersecurity auditor (RENASC – IDASC QC-18310A7), recognised in regulated contexts such as BNR, ASF and ADR.
A clear approach
We don’t overcomplicate things. We explain simply what matters and what to do next.
FAQ
Frequently asked questions
Start with a simple assessment and receive concrete steps within 24h.
What is the difference between an audit and penetration testing?
The audit shows you the big picture: how security controls are built, how well processes are defined and where the risks are.
Penetration testing looks more closely at the technical side: it simulates real attacks to see whether those risks can actually be exploited.
Put simply, the audit tells you where you stand, while testing shows you what can happen in practice.
What is a gap analysis?
A gap analysis is a simple comparison between:
- what you have now
- and what you should have (according to a standard or requirement)
It helps you see clearly what is missing to achieve compliance or the desired level of maturity.
It is especially useful when you are preparing for a regulation, a project or an official audit.
Who needs a security audit?
Usually, organisations that:
- operate in regulated industries (financial, energy, IT, healthcare, etc.)
- need to comply with requirements such as NIS2, DORA, BNR, ASF or ADR
- handle sensitive or critical data
- work with partners who ask for evidence of security
- are going through digitalisation or major IT implementations
How long does an audit take?
It depends on the size of the organisation and the complexity of its systems.
It can range from a few days to a few weeks.
After an initial discussion, we can estimate the duration and the steps involved fairly clearly.
Does an audit mean I get a certification?
No. The audit gives you a clear, documented assessment of the current situation, plus concrete recommendations.
Certification or final compliance depends on how the measures are subsequently implemented.
What should I prepare before the audit?
In general, it helps to have:
- an overview of the IT infrastructure
- internal policies and procedures (if any)
- information about the applications and systems in use
- any applicable compliance requirements
If you don’t have all of these organised, that’s not a problem. We’ll do it together, step by step!
Is the report technical or easy to understand?
Both.
It has the technical detail IT teams need, as well as a clear explanation for management, so that decisions can be made easily, without complicated interpretation.
Can I also use the audit in discussions with partners or authorities?
Yes.
The report is often used as a basis for:
- relationships with business partners
- due diligence processes
- compliance requirements
- checks by authorities or external auditors
What happens after the audit?
After the audit, you usually have three options:
- remediate internally what has been identified
- continue with penetration testing for technical validation
- or move on to consulting for a security plan and prioritisation
There is no single right direction; it depends on the context.
Want a clearer picture of where you stand?
If you need an objective assessment of your security posture, the measures in place or your level of compliance, we can start with a discussion about your organisation’s context.
Together, we will look at what is relevant, what is worth assessing and what the most suitable approach is.