Risk and rules
From “we should do something about security” to a simple written plan that holds up when customers, the board or authorities ask.
01 / Do I need this?
Do I need this?
- You store customer data and aren't sure you follow GDPR
- A customer or partner sent you a security questionnaire
- You've never thought about what happens if your systems stop
- You wonder whether the new EU rules (NIS2) apply to you
02 / What we do
What we can help with
Risk assessment
What could go wrong?
We go through the business with you, find the most important risks, and what to do first.
Gap analysis
Where are you today?
We compare what you do today with what's required, and list what's missing.
Management system
Simple routines and responsibilities
Who is responsible for what, and which routines you need. Written so people actually use them.
GDPR and DPIA
Privacy
An overview of what personal data you hold, why, and how it's protected.
Supplier review
Can you trust your suppliers?
We check that those handling data for you take security seriously.
Preparedness
A plan for when something happens
What you do in the first hours after an attack or a major outage.
03 / Example
What you get
You get a short list of the most important risks: what could happen, how likely it is, and what to do first. No thick binders.
Your action plan
- 1This week
- 3This month
- 5This year
This week: Routine for checking invoices before payment (fake invoices)
Action: Changed account numbers are always confirmed by phone.
This month: Tested backup of the finance system
Action: Restore a copy and check that everything is there.
This year: Written plan for what you do if attacked
Action: One page: who calls whom, and what to shut down first.
We walk through the plan with you, and follow up as agreed.
You always get a short summary for management and a detailed part for whoever will fix things.
04 / NIS2
Do the new EU rules apply to us?
NIS2 is a new set of EU security rules. In Norway they arrive through the Digital Security Act.
They mainly apply to medium-sized and large organisations in important sectors, such as energy, transport, health, water, digital infrastructure and parts of manufacturing.
Small businesses can be affected too, often because a customer covered by the rules sets requirements for its suppliers.
In practice: assess risk, have basic security in place, and have a plan to report if something happens. We help you find out whether the rules apply to you, and what needs doing.
05 / For IT managers
For IT managers
Free check of your email
Could someone send email that looks like it came from you? We check how your domain is configured. You get the answer by email within a few minutes when you use an address on the domain you want checked. We only use publicly available information.
Free, with no obligation. We won't call to sell you anything.
Questions you may have
- Will this be expensive?
- You get a written price before we start. No surprises.
- Are we too small?
- We mainly work with businesses that don't have their own IT department.
- Will it be technical and complicated?
- You get a one-page summary in plain English.
- Could you break something?
- We never test without a written agreement, and agree in advance what is safe.
Next step
Tell us what you need
Tell us briefly what you need. We reply within one business day with a suggestion for how to proceed.