Compliance readiness
Regulatory readiness done as engineering work: one control set, mapped once, evidenced continuously, and reused across every framework that asks the same question in different words.
Updated
Approach
01Applicability
Establish which regimes actually bind you, in which entity, for which service and by when. I record assumptions and hand legal interpretation to the legal or compliance owner.
02Single control set
Define one internal control set and map it to each framework rather than maintaining parallel programmes. The same identity, supplier, incident or change control should not produce five different processes.
03Gap assessment
Review design and operating effectiveness from evidence: configurations, approvals, tickets, logs, supplier records, test results and incident records — not policy existence alone.
04Remediation plan
Sequence work with owners, dependencies, evidence artifacts and decision points named up front. The plan separates quick evidence gaps from controls that need architecture, procurement or management action.
1Internal control set
- Access control
- Logging
- Third-party risk
- Resilience testing
2Mapped to
- DORA
- NIS2
- ISO 27001
- GDPR
- EU AI Act
3Evidence source
- Cloud config
- Identity logs
- Change records
- Test reports
4Output
- Audit evidence pack
- Gap register
- Remediation plan
| Theme | DORA | NIS2 | ISO 27001 |
|---|---|---|---|
| Governance and accountability | Management body responsibility | Management body duties and training | Clause 5 leadership |
| Incident reporting | Major ICT incident reporting | Significant incident notification | A.5.24–A.5.28 |
| Third-party risk | ICT third-party register | Supply chain security | A.5.19–A.5.22 |
| Resilience testing | Threat-led penetration testing | Testing obligations | A.8.8, A.8.29 |
The output is a control-to-obligation matrix, evidence register and remediation plan. Each artifact names the system of record, owner and sample that demonstrates operation. Exceptions are explicit: the right risk owner, expiry date, compensating controls and review trigger — not an untracked waiver.
Frequently asked questions
Do you certify us?
No. Certification is done by an accredited body; I get you to the point where that audit is uneventful.
Can this run alongside a compliance officer?
Yes, and it works best that way. I hold a Compliance Officer certificate (PIKW) and work as the technical counterpart to a legal or compliance lead.
Related
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.
Compliance
Turning DORA, NIS2, ISO 27001, GDPR and the EU AI Act into one control set with reusable evidence and aligned reporting clocks.
Compliance Officer (PIKW)
Compliance Officer certificate from the Polish Institute of Internal Control (PIKW): compliance programme design, controls and reporting.
CISO advisory
Security leadership support for organisations without a full-time CISO: strategy, roadmap, board reporting and vendor decisions.
DORA, NIS2 and the AI Act
A control-level comparison of DORA, NIS2, the EU AI Act, ISO/IEC 42001 and ISO 27001 — what you can evidence once and reuse across all of them.
CPPC (public sector)
Cybersecurity expert at Centrum Projektów Polska Cyfrowa (CPPC): technical evaluation of Digital Europe Programme proposals and SME cybersecurity grant assessment.