Service
Closed before the audit.
Law 547, PCI DSS, ISO 27001: gap analysis, policies and a roadmap. We close the gaps before the audit.
- Law 547
- PCI DSS
- ISO 27001
- Risk
Why it matters
The problem
The documents exist, but whether reality matches them is too late to learn on audit day. A gap analysis shows the distance between requirement and reality in advance.
Our answer
We turn the requirements into a readable list, rank the gaps by priority and help close them before the review.
What is included
06 modulesCompliance and risk
- Law 547
- PCI DSS
- ISO 27001
- Risk
- 01
Gap analysis
For every requirement: present, partial, missing, with evidence.
- 02
Law 547
Requirements of the cybersecurity law: organisational and technical measures.
- 03
PCI DSS
Payment card data: scope, segmentation, the 12 requirements.
- 04
ISO 27001
ISMS: policies, risk assessment, controls, internal audit.
- 05
Risk assessment
Assets, threats, likelihood and impact: a table for decision making.
- 06
Policies and documents
Missing documents are drafted, existing ones adapted.
How it goes
04 steps
- 01
Scope
Which standard, which systems, which deadline.
- 02
Assessment
Documents, interviews, technical review.
- 03
Gaps and plan
A roadmap ranked by priority.
- 04
Closing and preparation
Fixes, documents, audit preparation.
What you get
- 01
Gap report
Status and evidence for every requirement.
- 02
Roadmap
With deadlines and owners.
- 03
Document set
Policies, procedures, risk register.
Questions
All servicesDo you certify yourselves?
No, we prepare; the certificate is issued by an accredited body.
How long does it take?
Gap analysis two to four weeks; closing depends on the organisation.
Does a small company need this?
If you accept payments or store personal data, yes.
Do you help after the audit?
Yes, with closing findings and the retest.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start