Security & Compliance Consulting

We deliberately advise on two frameworks: ISO/IEC 27001 and the Cyber Resilience Act. Both require knowledge that reaches into processes and technology – which is exactly where our strength lies.

ISO/IEC 27001

International management system standard, certifiable

Support in building and improving information security management systems under ISO/IEC 27001.

  • ISMS
  • Risk assessment
  • Policies
  • Audit preparation

Cyber Resilience Act

Regulation (EU) 2024/2847, mandatory for products in scope

Supporting software manufacturers in the technical and organisational preparation for the requirements of the Cyber Resilience Act.

  • Gap analysis
  • Product classification
  • Vulnerability management
  • SBOM
  • Security updates

The two frameworks compared

ISO/IEC 27001Cyber Resilience Act
SubjectThe organisation and how it manages information securityProducts with digital elements
Legal natureInternational standard, voluntaryEU regulation, directly applicable
EvidenceCertificate issued by an accredited certification bodyConformity assessment, EU declaration of conformity and CE marking
TimelineOngoing, with surveillance and recertification auditsReporting obligations from 11 September 2026, remaining obligations from 11 December 2027
Typically relevant forOrganisations that want to demonstrate information security to customers and partnersManufacturers, importers and distributors of hardware and software

Our stance

Compliance is not an end in itself. An ISMS or a CRA-ready development process succeeds when it actually improves security and is lived in daily work.

Because we develop software ourselves, we translate requirements into concrete technical measures – and recognise where a requirement reaches its limits in operation.

We support preparation and implementation. Certification is performed by accredited bodies; please clarify legal questions with your legal counsel.

Let us talk about your requirements.

Whether it is a secure development process, an ISMS, preparing for the Cyber Resilience Act or controlled use of AI: a first conversation clarifies where you stand and which next step makes sense.

Get in touch