Security Maturity Audit
The security maturity audit is the essential starting point of any security initiative. It gives a clear and objective picture of your security posture across 9 assessment domains, ranging from governance to technical measures.
Based on our MScoR methodology, the audit rates each domain on a scale of 5 maturity levels. The goal is to give you a view of priorities and risks so that you can make informed decisions.
The deliverable includes a detailed report with scoring per domain, a map of the identified risks and a prioritised action plan with S.M.A.R.T. objectives.
Risk Analysis
Risk analysis makes it possible to identify, assess and prioritise the threats facing your information system. Each risk is classified along three levels of criticality: Critical, Watch and Improvement.
Our approach is based on the EBIOS RM methodology (recommended by ANSSI, the French national cybersecurity agency) and ISO 27005 best practices to ensure an appropriate, repeatable and continuous analysis. Prioritisation is directly linked to business urgency: operational, financial, regulatory and reputational impact.
The result is an actionable risk matrix with concrete treatment recommendations: mitigation, transfer, acceptance or avoidance.
Strategic Action Plan
Based on the results of the audit and the risk analysis, we build a tailored roadmap. This action plan turns findings into concrete actions that can be budgeted and scheduled.
Each action is defined with S.M.A.R.T. objectives (Specific, Measurable, Achievable, Relevant, Time-bound), a named owner, a budget estimate and tracking milestones. The plan takes into account your business and operational requirements and strategies.
We also offer quarterly follow-up support to measure progress, adjust priorities and keep the improvement momentum going.
ISO 27001 Implementation
ISO/IEC 27001:2022 is the international standard for managing and protecting an organisation's information. It is built on an Information Security Management System (ISMS). We support you at every stage, from the initial gap analysis to certification readiness.
Our support notably covers writing policies and procedures, producing the Statement of Applicability (SoA), defining the ISMS scope, training your teams, internal audits and preparing for certification audits.
As a certified ISO 27001:2022 Lead Implementer, we bring first-hand expertise of the standard's requirements and of certification audits, while adapting the approach to the operational realities of SMEs and mid-sized companies.
ISO 27001 and NIS 2. The NIS 2 Directive requires essential and important entities to manage their cybersecurity risks and report significant incidents. An ISO 27001 information security management system covers most of these risk-management measures, making it a solid foundation for NIS 2 compliance.
AI Governance
Adopting artificial intelligence in the workplace creates new, specific risks: data leaks through prompts, algorithmic bias, regulatory non-compliance (EU AI Act), and shadow AI used by staff without any oversight.
Our support is based on the ISO 42001 standard (AI management) and on the regulatory requirements of the AI Act as well as OWASP best practices to help you define a clear, secure and compliant AI usage policy. We assess your existing uses, identify the associated risks and put in place an appropriate governance framework.
The deliverable includes an AI acceptable use policy, an AI use-case register, an impact assessment and technical security recommendations tailored to your needs.
Awareness & Training
Studies in 2025 and 2026 agree: the human factor remains the leading weak point in cybersecurity. Raising awareness and training your teams is an essential lever for reducing your attack surface. Our programmes are tailor-made and adapted to each profile: management, IT teams and business staff.
We offer hands-on workshops based on real-life scenarios: phishing, social engineering, password management, data classification and remote-working best practices. Each session includes role-plays and practical exercises.
For a lasting impact, we draw on lessons learned from real incidents and offer solutions to measure how the security culture evolves within your organisation. As an ISC2 Authorized Instructor for CISSP, we can also help your teams prepare for the CISSP certification.
Need a tailor-made service?
Every organisation is unique. Let's talk in a scoping call, with no commitment, to understand your challenges and send you a proposal tailored to your context and budget.
Request an assessment