DORA
EU. Five pillars: ICT risk, incident reporting, resilience testing, third-party risk, information sharing.
Cybersecurity & IT Compliance
We turn regulatory requirements into working IT systems.
Regulatory knowledge that maps onto process — and GRC plus ITSM that talk — so cyber and IT risk sit on live operational data, not slideware.
Landscape
Two areas of expertise. One connected field.
Regulation and the ISO/IEC 27000 family at the top. The ISMS in the middle, split by line of defence: the 1st line operates and owns risk, the 2nd line defines and oversees. ITSM/CMDB and GRC carry each line, joined by a live data loop.
1ST LINE
Operate & own risk: IT operations, control owners.
2ND LINE
Define & oversee: ISO/ISB, risk control, compliance.
3RD LINE
Independent assurance: internal audit.
Regulation & Standards
What applies, and the standard most institutions use to answer it.
BaFin · MaRisk
DE. Three lines of defence; independent risk control and compliance functions.
FINMA Circ. 2023/1
CH. Operational risks and resilience, including ICT and cyber risk.
NIS2
EU. Cybersecurity risk management and reporting for essential and important entities.
ISO/IEC 27000
The standards family behind the ISMS.
ISO/IEC 27001
ISMS requirements. The certifiable core.
ISO/IEC 27002
Guidance for the 93 Annex A controls.
ISO/IEC 27005
Information security risk management.
ISMS · ISO/IEC 27001
PLAN · DO · CHECK · ACT
1ST LINEOperate & own risk
Control operation
Run Annex A controls day to day: access, change, backup, logging.
Incidents & changes
Detect, log and classify. Feeds DORA incident reporting.
Asset & service ownership
A named owner for every asset and service in the CMDB.
2ND LINEDefine & oversee
Scope & policies
ISMS scope, information security policy, roles and responsibilities.
Risk assessment & SoA
Method per ISO/IEC 27005; Statement of Applicability.
Monitoring & reporting
Control testing, risk indicators, reporting to management.
CHECK · ACT
Internal audit (3rd line) and management review close the ISMS cycle.
Supporting IT Systems
ITSM / CMDB
Setup, configuration, maintenance — incident, change, request, CMDB, ownership, lifecycle.
GRC
Setup and modification — risk register, control library, assessments, attestations, evidence.
Live loop: asset ↔ change/incident ↔ control ↔ risk ↔ evidence. The 1st line records, the 2nd line sees it without asking.
Next
Bring the audit finding or the tooling gap.
If GRC and ITSM already exist but do not talk — or the regulation is clear but the stack is not — that is usually where we start.
Contact