Security and privacy rules have multiplied, and most organisations now answer to several at once: data protection law, sector regulation, a national security scheme, and whatever their largest customers write into contracts. Each asks for similar things in different words.
Our compliance service works out which of them apply to you, measures where you stand against each, and takes you from there to the point where you can show an auditor, a regulator or a customer that you meet them.
We do it as security practitioners. The aim is controls that actually protect you, with the paperwork as a record of them, not paperwork that describes controls nobody operates.
Frameworks we work with
We work with the frameworks our clients are most often asked about.
- GDPR and national data protection law: records of processing, legal bases, impact assessments, data subject rights and breach handling.
- NIS2: risk management measures, incident reporting and supply chain security for essential and important entities.
- ENS, the Spanish National Security Scheme, for public bodies and the suppliers that serve them.
- ISO/IEC 27001: building and operating an information security management system.
- DORA, for financial entities and their technology providers.
If you are subject to something else, tell us. Most frameworks share a common core, and work done for one carries over to the next.
We prepare you for certification and stay with you through the audit. The certificate itself is issued by an accredited certification body, which has to be independent of whoever prepared you, so that part is not ours to give.
How we work
First, scope. We establish which rules apply to you and to which parts of the organisation, because being subject to a framework you did not know about is the most common finding of all.
Second, a gap assessment. We compare what the framework requires with what you do today, control by control, and tell you where you already comply, where you are close and where there is real work.
Third, a plan ordered by risk and effort, with owners and dates. We help you carry it out: writing the policies and procedures you lack, defining the technical measures, and training the people who will operate them.
Where a framework requires technical testing, such as penetration tests or vulnerability management, our own team carries it out through our Cybersecurity audit service, so the results feed straight into the compliance record.
Evidence, kept in order
Being compliant and being able to prove it are different problems. An auditor does not ask whether you review access rights; they ask to see the last three reviews.
We keep the evidence for each control in Durandir Harness, one of the tools we build: what the requirement is, what you do to meet it, and the record that shows it was done, each with its date and source. When the audit comes, the answer to every request is already in one place.
The same record serves several frameworks at once. A control that satisfies ISO 27001, ENS and NIS2 is documented once and mapped to all three.
We stay with you
Compliance is not finished on the day of the audit. Rules change, your systems change, and certificates have to be renewed.
You have one person at Durandir who knows your organisation. We sit beside you during the audit, answer the auditor's questions with you, and help you close whatever findings come out of it.
Afterwards we can stay on with periodic reviews, so the next audit is a check on work already done and not a scramble.
What you receive along the way: the applicability analysis, the gap assessment, the action plan, the policies and procedures written for your organisation, and the evidence record ready for audit.