Compliance
Regulatory compliance as the result of a good security programme
Regulations change and overlap, but they ask the same questions: do you know your risk, do you have your suppliers under control, can you respond to an incident. That is why we do not sell compliance with a single regulation. We build a cybersecurity programme that compliance follows from.
Our approach
- Security first, evidence second. Documents describe what the organisation actually does.
- One programme, many regulations. We build risk analysis, incident handling and supplier oversight once, not separately for each act.
- In proportion to scale. We match safeguards to the organisation's risk and size.
- Also without a legal obligation. We help organisations that are not covered by any of these regulations but want to operate securely, or whose clients require it.
What they have in common
| Programme element | NIS2 and KSC | GDPR | CRA | DORA |
|---|---|---|---|---|
| Risk analysis | Risk management in the information system | Risk assessment and choice of safeguards (Art. 32) | Cybersecurity risk assessment of the product | ICT risk management framework |
| Incidents and reporting | Reports within 24 and 72 hours and a final report | Breach notification within 72 hours (Art. 33) | Reporting of exploited vulnerabilities and severe incidents, early warning within 24 hours | Reporting of major ICT-related incidents |
| Suppliers | Supply chain security | Processors (Art. 28) | Product components and suppliers | ICT third-party service providers, contractual requirements |
| Management accountability | Duties and training of the head of the entity | Accountability of the controller | Obligations of the manufacturer | Responsibility of the management body |
NIS2 and KSC
Applies to essential and important entities, which have until 3 April 2027 to meet their obligations. We start with a readiness review that includes a check of your status on the KSC register, implement the requirements in modules and keep the system running through ongoing support. We also train management.
GDPR
We work where data protection meets cybersecurity: technical and organisational safeguards, risk assessment, breach handling and security at processors. We do not act as a data protection officer, we work alongside your DPO or law firm.
CRA
The Cyber Resilience Act covers products with digital elements. The reporting obligation applies from 11 September 2026, most other obligations from 11 December 2027. We assess suppliers and their products against the CRA on the buyer's side. We also support manufacturers in preparing for the CRA requirements: default products, where conformity is demonstrated by self-assessment, and important products in class I where the manufacturer applies harmonised standards. We do not carry out certification. See our analysis of the CRA's impact on the healthcare supply chain.
DORA
The Digital Operational Resilience Act for the financial sector has applied since 17 January 2025. It covers financial entities and, indirectly, their ICT service providers. We support financial entities, smaller ones in particular, in managing ICT risk and supplier risk. We also help ICT providers meet the requirements that financial entities pass on to them in contracts.
Where to start
With a readiness review. In 2.5 days we establish which regulations apply to you, what already works and what is missing. The result is one list of gaps and one 90-day plan, not a separate project for each regulation.
Frequently asked questions
Not always. You can have a complete set of documents and still be unable to respond to an incident. That is why we start from the actual state and treat compliance as a result.
No. We build the shared elements, such as risk analysis, incident handling and supplier oversight, once.
Yes. We agree the scope in the readiness review and build it so that further requirements do not mean starting from scratch.
Yes. We help build security in proportion to scale even when the law does not require it.
No. Under the GDPR we work where data protection meets cybersecurity.
Let us talk about the security of your organisation
You do not need to be ready for a large project. A conversation about where you are and what the law requires of you is enough. We will help you plan realistic, workable steps.
- contact@isconsulting.pl
- Address
- ul. Żelazna 51/53, 00-841 Warszawa, Poland