Cybersecurity
One security programme and one ISMS that answer auditors, regulators and your board.
The problem
Security rules now come from several directions. NIS2, implemented in Germany by the NIS2UmsuCG, makes management bodies responsible for cybersecurity risk management. DORA has applied to financial entities since 17 January 2025. Customers ask for ISO/IEC 27001.
Many organisations answer each request separately, tool by tool and spreadsheet by spreadsheet. The result is overlapping products, controls nobody checks and gaps between what is written and what actually runs, which costs time at every audit.
What we do
We define the scope and compare your security organisation and controls with ISO/IEC 27001:2022, NIS2 and, for financial entities, DORA.
We define your security programme with priorities, roles and a roadmap, and design the target architecture for identity, data, network, cloud and AI.
We identify, assess and communicate information security risks and agree a treatment plan with the risk owners.
We write the policies, define roles and processes and select the applicable controls from the 93 in Annex A, documented in a Statement of Applicability.
We help your teams put the controls in place, including incident handling, supplier and ICT third-party risk, and add security requirements to your software lifecycle.
We run internal audits and the management review, close findings, prepare you for certification and keep the ISMS current as rules change.
How we deliver
We assess your security governance against ISO/IEC 27001, NIS2 and DORA and set the strategy, target architecture and roadmap.
Learn moreWe build the ISMS with you: policies, risk register, Statement of Applicability, processes and audit preparation.
Learn moreWe run ongoing GRC activities: risk reviews, internal audits, control monitoring and regulatory change tracking.
Learn moreFrameworks
Platform
From December 2026, the Fidempli platform tracks every accepted risk with an owner, an expiry date and a live check, and keeps evidence ready for auditors. AI-related controls sit next to your ISMS, not in a separate spreadsheet.
Explore the platform
No. Certification is done by an accredited certification body. We build the ISMS with you and prepare you for the certification audit.
Annex A lists 93 controls in four themes: organisational, people, physical and technological. You decide which apply and justify it in the Statement of Applicability.
It depends on your sector and size. We check whether you fall under NIS2 and, in Germany, the NIS2UmsuCG, and which obligations follow.
For financial entities in scope, DORA sets the rules for ICT risk management, incident reporting, resilience testing and ICT third-party risk. We help you work out which rules apply to you and build one set of controls for both.
We design to your requirements first and only then assess products. Products are chosen to fit the architecture, not the other way round.
Each framework also has its own page under Solutions, by framework, which shows how the requirements map to the Fidempli platform.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
