Cybersecurity assessment in Europe
In Europe, ISO 27001 is the standard customers ask for, NIS2 sets legal obligations through each member state’s own law, and DORA applies directly to financial entities and reaches their ICT providers through contracts. Many organizations answer to two or three of these at once. We assess them together, so one control and one piece of evidence serve each.
Who it is for
- Organizations going for ISO 27001 certification, or preparing for a surveillance or recertification audit.
- Medium and large organizations in the sectors NIS2 lists, and groups operating in several member states with different national rules.
- EU banks, insurers, investment firms, payment institutions and other financial entities within DORA’s scope.
- ICT and service providers facing NIS2 or DORA security clauses in their customers’ contracts.
What we assess against
ISO/IEC 27001:2022 readiness
We test your information security management system before your certification body does: the management clauses, the 93 Annex A controls, and the Statement of Applicability that ties them together. ISO 27001 is international, and we assess it wherever you are.
- Clauses 4 to 10, from scope and risk treatment to internal audit, management review and improvement.
- All 93 Annex A controls across the four themes, organizational (37), people (8), physical (14) and technological (34), each tested against evidence.
- Whether every inclusion and exclusion in your Statement of Applicability is justified by your risk assessment.
- The physical controls in A.7, tested on site by the same team. See ISO 27001 Annex A.7.
NIS2 Directive
NIS2 applies from 18 October 2024 through each EU member state’s national law. It sets risk-management measures, strict incident reporting deadlines and personal accountability for management. We assess against each obligation as your country has implemented it.
- Applicability: whether you are an essential or important entity, and in which member states.
- The Article 21 measures, from risk analysis and incident handling to supply chain security, multi-factor authentication and cryptography.
- Article 23 reporting: an early warning within 24 hours, a notification within 72 hours and a final report within one month, with a runbook built around those deadlines.
- Management body duties: approving the measures, overseeing them, and training.
DORA
The Digital Operational Resilience Act has applied since 17 January 2025. Unlike NIS2 it is a regulation, so it applies directly and the same way across the EU. We assess where you stand on each of its pillars.
- ICT risk management framework and governance.
- ICT-related incident classification and reporting.
- Digital operational resilience testing, including whether threat-led penetration testing applies to you.
- ICT third-party risk: contracts, exit plans and the register of information.
How we assess
- One assessment mapped across ISO 27001, NIS2 and DORA where more than one applies, so the same evidence counts for each.
- The national implementation of NIS2 in every member state you operate in, since registration, reporting channels and some duties differ.
- Physical and environmental controls, which all three include, tested on site rather than on paper.
- Cloud configuration and data residency where they are in scope. See cloud security audit.
What you receive
- A register for each framework in scope: clause, article or control, evidence, rating, owner and fix.
- For ISO 27001, a review of your Statement of Applicability; for NIS2, an applicability memo per member state; for DORA, a review of your register of information and critical ICT contracts.
- A prioritized remediation plan with a price range on every item.
- A readout for leadership and the management body.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically three to five weeks for one framework and one entity, longer when several frameworks or member states are in scope.
Common questions
Do you issue the ISO 27001 certificate?
No. Certificates are issued by accredited certification bodies after a Stage 1 and Stage 2 audit, and we are not a certification body. We assess readiness so the certification audit has fewer surprises, and we have no commercial tie to any certification body.
Our ISMS was built on ISO 27001:2013. Does that matter?
Yes. The 2013 edition has been withdrawn and the transition period has ended, so certification audits are now against ISO/IEC 27001:2022. Its Annex A was restructured into 93 controls, including new ones such as threat intelligence, configuration management and data leakage prevention. We map your existing controls onto the 2022 structure so earlier work carries over.
What are the fines under NIS2?
Member states must allow fines of at least up to €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher. National law can set them higher.
How does DORA relate to NIS2?
For financial entities in its scope, DORA is the specific law and takes precedence on ICT risk management and incident reporting. We assess both at once where you are subject to both.
We are an ICT provider, not a bank. Does DORA affect us?
Yes, through your contracts: financial entities must include specific provisions in agreements with ICT providers. Providers designated as critical are also overseen directly by the European supervisory authorities.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Europe
We reply within one business day.
Nothing you send is shared outside Calibre.