Are we in scope?
Based on sector, size and activity, we assess whether and how NIS-2 or DORA applies to your organisation.
Service 04
NIS-2 and DORA — pragmatically implemented.
Implementation of the new EU regulations for critical infrastructure, the financial sector and essential entities. Gap analysis, action plan, implementation, reporting duties — pragmatic and audit-ready.
Regulation is not a paperwork exercise.
NIS-2, DORA and the AI Act bring new obligations for critical infrastructure, the financial sector and many mid-sized companies — including the accountability of management. Many organisations still aren’t sure whether they are affected at all.
We first clarify whether you are in scope, then the gaps, then the measures — and implement them so that they hold up in an audit and work in daily operations. Because penetration testers, forensic specialists and compliance experts work together at CIN, measures don’t stay on paper.
Typical engagements
When you need us.
Gap analysis
An honest comparison between requirements and current state — with a prioritised, realistic action plan.
Incident reporting processes
Under NIS-2, significant incidents require an early warning within 24 hours. We build processes that manage this on a Friday evening, too.
ICT providers and supply chain
Defining requirements for providers, reviewing contracts and evidence, making dependencies visible.
Scope
What we actually do.
- Scoping analysis for NIS-2 and DORA
- Gap analysis and prioritised action plan
- Risk management and security concepts
- Incident response and reporting processes
- Supplier and ICT third-party management
- GDPR and the AI Act in combination
Process
How we work.
-
Scoping
Clarifying which regulations apply and which obligations follow from them.
-
Gap analysis
Comparison with the current state, prioritised by risk and effort.
-
Implementation
Technical and organisational measures — together with your teams.
-
Evidence
Documentation that holds up in an audit, and training for those responsible.
From practice
A glimpse of our work.
Anonymised in agreement with our clients. Details are shared on request and under confidentiality.
Red-team engagement at a critical-infrastructure operator
Full-scope penetration test including social engineering, physical intrusion and OT/IT segmentation. Identification of weaknesses in network architecture and operational processes. A NIS-2-compliant action list and awareness programme for operations and commercial-technical teams.
Details on request
Let’s talk about your case.
The initial consultation takes about 30 minutes and is free and confidential. For acute incidents, please mark your request as urgent.