The regulatory framework for security changes constantly and arrives as text that is hard to translate into concrete tasks. The usual outcome is a folder of documents nobody applies.
We work mainly with the Spanish National Security Framework (ENS) and with ISO/IEC 27001, helping you meet the requirements that genuinely apply to you, with a clear roadmap, realistic deadlines and evidence ready for when the audit arrives.
It is the set of legal, contractual and sector obligations an organisation must satisfy to demonstrate that it adequately protects the information it handles.
Compliance is not about having policies written down, but about proving with evidence that controls exist, work and are reviewed. That is the difference between passing an audit and failing one.
Although every organisation has its own obligations, most of our projects revolve around two reference frameworks:
It is mandatory for public administrations and for the companies that provide services to them. We define your category (basic, medium or high), measure compliance against the Annex II controls and prepare the documentation and evidence the certification audit requires.
It is the international standard for information security management systems. We help you implement the full ISMS: risk assessment, statement of applicability, policies, controls and internal audit, until you are ready to face certification.
Beyond avoiding penalties, regulatory compliance has direct effects on the business:
We analyse which regulations genuinely apply to you and measure how far you meet them. We find gaps, legal risks and areas to improve: we tell you where you stand before proposing where to go.
We produce a detailed plan with concrete actions, realistic deadlines and named owners. Prioritised by risk, so you close your biggest exposures first without paralysing day-to-day operations.
We draft and adapt the policies and procedures you need and implement the controls behind them. We leave the documentary trail that any auditor will later ask for.
We organise the documentation and evidence, rehearse the usual questions and accompany you through the audit or inspection so there are no surprises.
Regulations move. We keep your compliance up to date as rules change or new sector requirements appear, with periodic reviews and alerts when something affects you.
We are technical consultants, not only legal ones: we understand the control behind each requirement and we know how to implement it, not merely describe it.
We translate the regulation into understandable language and assignable tasks, and we stay until they are done.
It depends on your sector, your size, the type of data you handle and whether you provide services to public administration or regulated sectors. The initial assessment exists precisely to determine this: over-complying also costs money.
An assessment takes weeks. Full compliance depends on your starting point and scope, and is usually planned in phases over several months so the organisation can absorb it without slowing down.
Not necessarily. Compliance sets a required minimum, not an optimal level of protection. It is a very useful foundation, but it should be complemented with technical measures matched to your real risk.
Several regulations require notification within very short deadlines, in some cases 72 hours. Having the procedure defined in advance is the difference between a correct notification and an additional penalty.
Yes. We prepare the documentation, rehearse the usual questions and are present during the audit or inspection to resolve technical queries on the spot.
The Spanish National Security Framework sets the minimum security measures for public administration systems. It applies to public bodies and also to private companies providing services to them, which must demonstrate compliance at the relevant category.
We prepare you for certification: we implement the management system, document the controls and run the internal audit. The certificate itself is issued by an independent accredited body, and we accompany you through that external audit.
Yes, and it usually pays off. Both frameworks share a good part of their controls and documentation, so running a single project reuses much of the work instead of duplicating it.
We start with an assessment that tells you what applies to you, where you stand and what is missing.
Request information