Compliance & Regulatory Readiness
Regulations like NIS2 and DORA turn cybersecurity from a best-effort into a legal obligation with real penalties. We translate those requirements into a concrete, testable action plan — gap analysis, risk assessment and the penetration testing the frameworks demand — so compliance is evidenced by security that actually works, not just paperwork.
NIS2 & DORA Compliance Readiness
NIS2 and DORA compliance readiness — gap analysis, ICT risk assessment and the pentesting and TLPT these EU regulations require.
./open →SOC 2 Penetration Testing
SOC 2 penetration testing mapped to the Trust Services Criteria — the evidence auditors and enterprise customers expect before they sign off…
./open →HIPAA Penetration Testing
HIPAA penetration testing and Security Risk Assessment support for covered entities and business associates — manual testing of systems that store, process…
./open →CMMC Penetration Testing
CMMC Level 2 penetration testing mapped to NIST SP 800-171 — the technical evidence defense contractors need to protect CUI and pass…
./open →NYDFS Cybersecurity Regulation Penetration Testing
NYDFS Cybersecurity Regulation (23 NYCRR 500) penetration testing — annual and biannual testing evidence for New York-regulated financial and insurance entities.
./open →GLBA Safeguards Rule Penetration Testing
GLBA Safeguards Rule (16 CFR 314) penetration testing — annual testing and biannual vulnerability assessment evidence for financial institutions under FTC oversight.
./open →DORA TLPT — Threat-Led Penetration Testing
DORA-aligned threat-led penetration testing (TLPT) for EU financial entities — TIBER-EU-aligned scoping for significant entities, and resilience testing for firms below TLPT…
./open →NIS2 Compliance Penetration Testing
NIS2 penetration testing and compliance readiness for EU essential and important entities — Article 21 risk-management gap analysis and technical testing evidence.
./open →ISO 27001 Penetration Testing (Annex A.8.29)
ISO 27001 penetration testing mapped to Annex A.8.29 — the evidence certification auditors expect for security testing in development and acceptance.
./open →HITRUST CSF Penetration Testing
HITRUST CSF penetration testing — the technical evidence healthcare and healthtech organisations need to support r2 certification.
./open →Cyber Essentials Plus Penetration Testing
Cyber Essentials Plus penetration testing and technical verification — the hands-on assessment component UK organisations need alongside self-assessment.
./open →Cyber Insurance Penetration Testing
Penetration testing built to satisfy cyber insurance underwriting requirements — the evidence insurers and brokers increasingly demand before binding or renewing a…
./open →M&A Cybersecurity Due Diligence Penetration Testing
Cybersecurity due diligence penetration testing for M&A and investment transactions — independent technical evidence of the security risk you are acquiring or…
./open →FedRAMP Penetration Testing
FedRAMP penetration testing aligned to CSP guidance — the technical evidence cloud service providers need for a 3PAO assessment and federal ATO.
./open →FFIEC Penetration Testing
FFIEC-aligned penetration testing for banks and financial institutions — technical evidence mapped to FFIEC IT examination handbook expectations.
./open →NIST-Aligned Penetration Testing
NIST-aligned penetration testing, following SP 800-115 methodology and mapped to the NIST Cybersecurity Framework — a defensible technical baseline for any compliance…
./open →NERC CIP Penetration Testing
NERC CIP penetration testing for bulk electric system owners and operators — technical evidence mapped to CIP-005 and CIP-010 requirements.
./open →EU Cyber Resilience Act Penetration Testing
Cyber Resilience Act penetration testing and SBOM-ready security testing for products with digital elements sold into the EU market.
./open →NAIC Insurance Data Security Penetration Testing
Penetration testing aligned to the NAIC Insurance Data Security Model Law — technical evidence for insurers licensed in states that have adopted…
./open →HECVAT Security Assessment Support
Penetration testing and evidence support for vendors completing the HECVAT security questionnaire required by US colleges and universities.
./open →StateRAMP Penetration Testing
StateRAMP-aligned penetration testing for cloud service providers selling into US state and local government — the technical evidence authorization requires.
./open →MiCA Penetration Testing
MiCA-aligned penetration testing for Crypto-Asset Service Providers operating in the EU — platform, custody and ICT risk testing for licensing and supervision.
./open →PSD2 Security Penetration Testing
PSD2-aligned penetration testing for payment service providers and open banking platforms operating across the EU.
./open →Book a security assessment
Not sure which service fits? Tell us your goals and we'll scope the right engagement.
Talk to us