Cybersecurity & Privacy
One information security management system that answers auditors, regulators and your board.
The problem
Security rules now come from several directions. NIS2, implemented in Germany by the NIS2UmsuCG, makes management bodies responsible for cybersecurity risk management. DORA has applied to financial entities since 17 January 2025. Customers ask for ISO/IEC 27001.
Many organisations answer each request separately, with spreadsheets, scattered policies and controls nobody checks. That costs time at every audit and leaves gaps between what is written and what actually runs.
What we do
We define the scope and compare your current controls with ISO/IEC 27001:2022, NIS2 and, for financial entities, DORA.
We identify, assess and communicate information security risks and agree a treatment plan with the risk owners.
We write the policies, define roles and processes and select the applicable controls from the 93 in Annex A, documented in a Statement of Applicability.
We help your teams put the controls in place, including incident handling, supplier management and ICT third-party risk.
We run internal audits and a management review, close findings and prepare you for the certification audit.
We monitor compliance and risks over time and keep the ISMS current as your organisation and the rules change.
How we deliver
We assess your security governance against ISO/IEC 27001, NIS2 and DORA and give you a prioritised roadmap.
We build the ISMS with you: policies, risk register, Statement of Applicability, processes and audit preparation.
We run ongoing GRC activities for you: risk reviews, internal audits, control monitoring and regulatory change tracking.
Frameworks
Platform
From December 2026, the Fidempli platform tracks every accepted risk with an owner, an expiry date and a live check, and keeps evidence ready for auditors. AI-related controls sit next to your ISMS, not in a separate spreadsheet.
Explore the platform
No. Certification is done by an accredited certification body. We build the ISMS with you and prepare you for the certification audit.
Annex A lists 93 controls in four themes: organisational, people, physical and technological. You decide which apply and justify it in the Statement of Applicability.
It depends on your sector and size. We check whether you fall under NIS2 and, in Germany, the NIS2UmsuCG, and which obligations follow.
For financial entities in scope, DORA sets the rules for ICT risk management, incident reporting, resilience testing and ICT third-party risk. We help you work out which rules apply to you and build one set of controls for both.
Yes, it is a good basis. Both still have specific requirements, such as incident reporting, that we map and close as gaps.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
