Cyber security

Directly in scope are, broadly, medium and large organisations in the sectors the law lists, such as energy, transport, healthcare, manufacturing and digital services. Many smaller firms are drawn in indirectly because their customers must impose requirements on suppliers. We help you establish your position and anticipate what customers will ask.

Yes. Headcount is irrelevant once you process information about staff or customers. A small firm has fewer systems to review, yet the duties are identical, including reporting a breach to Datatilsynet within 72 hours.

It may be enough to answer a questionnaire, but it guards you against a reprimand rather than against losing data. We always separate what satisfies a requirement from what genuinely lowers risk, and leave the decision with you.

A SOC is a team of analysts who follow events constantly and step in when activity looks suspicious. For a smaller firm, EDR with a central console and well-chosen alerts is often sufficient. Continuous monitoring pays off when an hour offline is expensive or when NIS2 demands a fast response.

Documentation for a typical business is finished three to four weeks after the review. Technical measures depend on your environment and usually take one to three months. Everything runs remotely, so there is no need to clear diaries for meetings on site.