Compliance

The work takes weeks, the waiting takes months. What an ISO 27001 run consists of, what sets the pace, and how to plan backwards from a tender deadline.

AI drafts the documentation, our consultants adapt it with you, and the evidence gathers itself in a GRC tool. That is how the timeline holds up.

A customer wants ISO 27001 and NIS2 is on the way. Build one management system, let the paying deadline set the order, and the same work carries both.

The price of ISO 27001 is the sum of consultant hours, tooling, a GRC system, your own people's time and the audit fee. Here is what moves each one.

Your customer requires ISO 27001. Here is how to read the requirement, what you can answer today, and the realistic route to the certificate.

DORA sets two testing duties: a yearly programme every firm in scope runs, and threat-led penetration testing only where the authority designates you.

Software can hold your DORA register and your incident evidence. It cannot decide materiality, own the risk, or write your exit plan.

What DORA asks of internal audit, what leaves the building for Finanstilsynet, and what you show an auditor on an ordinary day.

What DORA makes you write down, what it makes you test, who has to approve it, and how often each of those has to happen.

The CRA is an EU law that ties cybersecurity rules to CE marking, so a product with digital elements cannot enter the EU market without it.

An ISO 27001 Lead Implementer builds your ISMS; a Lead Auditor checks it. Hire the wrong role and your certification project stalls.

How leadership teams move from compliance uncertainty to documented control, evidence that holds up under investor, customer, or regulatory due diligence.

SOC 2 can win you a US deal or burn six figures you did not need. Here is how to tell which, and how it fits ISO 27001.

A US prospect asks for your SOC 2 Type 2 report, you do not have one, and the deal stalls. Here is what it is and the decision it forces.

If Norway counts your firm as critical, you have had legal digital-security duties since October 2025, and most boards have not noticed.

Buyers increasingly require ISO 27001 certification to even let you bid, so missing it quietly drops you from shortlists you would have won.

A practical ISO 27001 checklist that takes a Norwegian small or mid-size business from "we should get certified" to a Stage 2 audit.

A ten-step DORA checklist for Norwegian banks, insurers, payment firms and asset managers, with Finanstilsynet deadlines and what to do this quarter.

A leader-facing NIS2 checklist for Norwegian SMBs, the scope self-test, who owns what, the reporting clock, what to budget, and the board questions to ask.

NIS2 obligations flow down through contracts, so you can be asked to prove security maturity even before the rule reaches Norwegian law.

Practical compliance steps for the new EU directive, what to do this quarter, and what can wait.