Cybersecurity serviceGOVERNANCE, RISK & COMPLIANCE

GRC Consulting & Regulatory Compliance

ISMS implementation, security master plans, and compliance roadmaps for NIS2, ENS, DORA, and ISO 27001, sustained afterward by HodeiShield so compliance doesn't depend on a one-off audit.

NIS2ENSDORAISO 27001
Typical duration
4 weeks
Deliverables
5+
Methodologies
NIS2 · ENS · DORA · ISO 27001
Next response SLA
< 24h
5DeliverablesInternal analysisInternal Hodeitek analysis: real count of the deliverables and phases defined for this service.
5Process phasesInternal analysisInternal Hodeitek analysis: real count of the deliverables and phases defined for this service.
0Zero production impactInternal analysisInternal Hodeitek analysis: an operating commitment for the service, not an audited metric.

Why do you need GRC Consulting & Regulatory Compliance?

No security master plan — reactive security costs 3x more than preventive and every audit catches you unprepared

NIS2, ENS, and DORA all at once — three regulations with overlaps and divergences that without experts end up as triple work

ISO 27001 as a never-ending project — certification can be structured in 9-12 months with a proper gap analysis and documentation from the start

Consultants who don't know your sector — a generic master plan doesn't work for critical infrastructure or financial services

What makes us different

Four pillars that apply to every service and every solution, not a one-off slogan.

Offensive + defensive + AI

The same team that attacks in the pentest runs the SOC and builds the AI models. Offensive insight informs defense, and AI is applied where we already operate, not bolted on as an extra layer.

Compliance in weeks, not months

HodeiShield, our own platform, automates continuous assessment, control mapping, and evidence generation — so manual work no longer sets the pace of regulatory compliance.

Sovereignty and proximity

Infrastructure on OVHcloud (France/EU). You speak with the people who sign off on the work, not an account manager who forwards your request to another department.

Our own product

HodeiShield isn't a third-party product we resell: we build and operate it ourselves, and that's what lets us offer faster compliance and evidence that's always current.

What's included

Deliverables and results you will receive with this service.

Regulatory Gap Analysis

Assessment of current state against the target regulatory framework (NIS2, ENS, DORA, ISO 27001) with identification of critical gaps and risk-based prioritization.

Security Master Plan

Roadmap prioritized by impact and effort with milestones, owners, estimated budget, and tracking metrics.

ISMS Documentation

Security policy, procedures, records, and complete documentation ready for ISO 27001 or ENS certification audit.

Certification Support

Support during ISO 27001 or ENS Medium/High certification, including prior internal audit and gap remediation.

Internal Team Training

Training of the internal team on implemented controls to ensure management system sustainability.

Methodology

Discovery, execution, delivery, and follow-up — the framework we follow on every project.

Discovery

Discovery

Thorough gap analysis against the target regulatory framework (NIS2, ENS, DORA, ISO 27001) to identify your current position and critical gaps.

Execution

Execution

We design the master plan and implement it: policy and procedure documentation, technical control configuration, and step-by-step support for your team.

Delivery

Delivery

Internal audit verifying effective control implementation and remediating identified gaps before external certification.

Follow-up

Follow-up

We support the external certification process and response to auditor findings, and leave your internal team trained to sustain the management system.

How we work

Structured methodology to ensure measurable and repeatable results.

1

Assessment

Thorough gap analysis against applicable regulatory frameworks. We identify your current position and gaps against NIS2, ENS, DORA, or ISO 27001.

2

Master Plan Design

We design the security master plan with control prioritization based on risk reduction vs implementation effort.

3

Implementation

Documentation of policies, procedures, and records. Technical control configuration. Step-by-step support for your team.

4

Validation

Internal audit to verify effective control implementation. Remediation of identified gaps before external certification.

5

Certification

Support during external certification process (ISO 27001 Stage 1 and 2, or ENS). Support in responding to auditor findings.

Operational example

A real scenario of how we work, not a marketing figure.

The ENS gap analysis reveals missing documented incident-management procedures. Instead of handing over a report that just flags the gap, we draft the procedure together with your team, test it in a drill, and leave it operational before the external auditor asks for it.

Is it for your company?

This service is designed for organizations that identify with these profiles.

Companies needing ISO 27001 or ENS certification for public or enterprise contracts
Financial entities required by DORA to structure their ICT risk program
NIS2-obligated companies without sufficient internal security staff
Management needing an executable master plan, not a document that ends up in a drawer

Compared to a generalist integrator

No names — here's how we work differently, with verifiable facts.

CriteriaGeneralist integratorHodeitek
FocusDozens of business lines; cybersecurity is just one of them100% cybersecurity and AI
Point of contactAn account manager who forwards your request to another departmentDirect contact with the founders
Regulatory complianceOne-off reports per regulation, manual evidence managementHodeiShield automates evidence and cross-framework NIS2/ENS/DORA mapping
ProductResells third-party licensesBuilds and operates HodeiShield, its own platform

Regulatory compliance

How what this service already includes relates to NIS2, DORA, and the AI Act — article by article, with no invented coverage.

  • Framework
    NIS2
    Article
    Art. 21
    What it requires
    Adopt appropriate and proportionate technical, operational and organisational cybersecurity risk-management measures.
    How this service helps
    The Regulatory Gap Analysis and the Security Master Plan cover that cycle: they identify the gaps against NIS2 and prioritize measures by risk, with the ISMS Documentation as evidence.
  • Framework
    NIS2
    Article
    Art. 23
    What it requires
    Notify significant incidents: early warning within 24h, incident notification within 72h, and a final report within 1 month.
    How this service helps
    The ISMS Documentation includes incident-management procedures — as this service's operational example shows, we draft and test them with your team before an auditor asks for them, the basis for being able to meet these notification deadlines.
  • Framework
    DORA
    Article
    Art. 5–16
    What it requires
    Maintain a documented and proportionate ICT risk management framework.
    How this service helps
    For financial entities, the Security Master Plan and ISMS Documentation are already built against DORA, as the service description states, structuring the ICT risk framework this block requires.

Informational mapping, not legal advice: it describes how what we already do in this service helps comply with or provides evidence for each article — it doesn't replace a compliance assessment tailored to your organization.

Frequently asked questions

What's your response SLA?
First response within 24 business hours of reaching out. If what you need is an exposure assessment, we deliver it in full within 48 business hours.
How long does it take to get ISO 27001?
Between 9 and 14 months from gap analysis to Stage 2 certification. With the technical foundation in place, timelines are significantly reduced.
What about ENS certification — how long does it take?
It depends on the category (basic, medium, or high) and your starting point. Unlike ISO 27001 — which runs on an external accredited auditor's schedule — the categorization, control-implementation, and evidence-generation process is measured in weeks, not months, thanks to HodeiShield's automation.
Can you support us if we already had a previous consultant?
Yes. We start by reviewing existing work to identify gaps and build on what's already done. We don't reinvent the wheel.
What's the difference between ENS and NIS2?
ENS is the mandatory Spanish framework for public sector and its vendors. NIS2 is the European directive. Spain has mapped ENS to NIS2 — with ENS covered, 70%+ of NIS2 is already resolved.
Do you use HodeiShield for evidence management?
Yes. For clients needing ongoing control and evidence management, HodeiShield is the tool we use to keep compliance up to date after the initial consulting engagement.
How is GRC consulting priced?
We don't publish a fixed rate: pricing depends on the target regulatory framework, the number of systems in scope, and your starting point. After the initial gap analysis, you receive a proposal with defined scope and price.
How are you different from a generalist integrator?
A generalist integrator often delivers a gap-analysis report and disappears; at Hodeitek we stay through certification with a single working framework for NIS2, ENS, DORA, and ISO 27001, and HodeiShield sustains compliance afterward. You deal directly with the founders.
Does the master plan change by sector?
The target regulatory framework depends on the sector: industry and essential-service providers work mainly with NIS2; financial services add DORA on top of NIS2/ISO 27001; the public sector certifies against ENS; and SMEs typically start with the minimum framework their client or regulator requires, expanding it only as they grow. A single master plan covers all four fronts if your organization overlaps several.

Your compliance needs a plan, not a PowerPoint

Talk to our team of experts to design a plan tailored to your organization's needs.

Request GRC assessment

Response within 24h

Case studies

How we've applied this service in real projects.

Bullhost · bullhost.tech

Strategic SOC consultancy since late 2023: from services not yet formalised into a catalogue to a proceduralised MSSP, with workflow automation, a catalogue structured into Blue, Purple and Red teams and a European data-sovereignty focus.

View case study
AZK Taldea · azk.eus

End-to-end securing of AZK Taldea, a branding and digital marketing agency: from an environment with no EDR, no firewall and no security culture to enterprise-grade defence across three layers —technical, human and the chain of their clients' websites—, with the SPRI cybersecurity grant managed by Hodeitek.

View case study

Related services

AI & Automation for Business

From use case to production system: we pinpoint where AI and automation deliver real return, then implement it —agents, system-to-system integrations, and custom copilots— with the data control and governance a business demands.

Learn more

Cybersecurity Training & Awareness

Awareness and technical training programs to make your team the first line of defense. From phishing simulations for the entire organization to advanced training for development and operations teams.

Learn more

SOCaaS / MDR — Security Operations Center

Continuous 24/7 monitoring of your infrastructure with expert analysts and advanced detection technology. Proactive threat hunting, real-time threat detection, and managed response — without building your own SOC.

Learn more

Solutions that apply this service

Third-Party & Supply Chain Risk Management

Assess, monitor, and govern the cybersecurity risk introduced by your vendors, third-party software, and your organization's Nth-party dependencies.

View solution

NIS2 Compliance

Comprehensive guidance to achieve and maintain compliance with the European NIS2 cybersecurity directive.

View solution

Cybersecurity for OT and Industrial Environments

Specialized protection for industrial control systems (ICS), SCADA, PLCs, and operational technology environments.

View solution