Risk assessment
An assessment based on the NSM ICT Security Principles, with a prioritised list of gaps. Preparation for NIS2, which Norway plans to adopt, and control mapping for ISO 27001 alongside your own certification process.
Risk assessment and security advice
An independent look at how your IT environment is protected, what would happen during an incident, and what to fix first.
What we look at
What matters most?
Which systems and information the business cannot do without, and what an interruption would cost.
Who can reach it?
Employees, administrators and suppliers, and whether their access matches what they actually need.
What would stop an attack?
Whether the network is segmented, whether critical systems are isolated, and whether an intrusion can be contained before it spreads.
Would you notice?
Whether an intrusion would be detected, by whom, and how quickly it can be isolated.
Independent security review
We review identity, network, servers, endpoints and backup as one environment. You get a written report for management and the board: findings, risk and prioritised measures in plain language.
You choose the scope, from a focused technical review to a broader one structured around NIS2 or based on ISO 27001. The review supports your own compliance work. It is not a certification.
What we deliver
Identity and access design
Multi-factor authentication, conditional access, privileged accounts and supplier access designed as one policy, then implemented in Microsoft 365 and on the network.
Network segmentation and isolation
Office, production, guests and suppliers separated, so a compromised device cannot reach everything. Where it is needed, critical systems and backups are isolated or kept offline.
Protection and recovery review
Endpoint, email, network and backup controls reviewed together, including whether backups survive an attack and whether recovery has been tested. Monitoring and response around the clock can be added through Secure.
Employees learn to spot phishing, fraud and the requests that should make them pause. Security awareness
Security testing
Scope and authorisation before testing
Before a penetration test or technical assessment, we agree the systems, objective, authorisation and boundaries with you. Testing method, who carries out the test, reporting and any retest are confirmed for the engagement. We do not test without written authorisation.
Common questions
Where should we start?
With the business and the current environment. A risk assessment identifies what matters most and where improvements should begin.
Is the review only for existing customers?
No. We can review your environment whoever runs your IT today.
Does a security service make us compliant automatically?
No. Technology is one part of a wider set of responsibilities. Any work on controls, documentation or specific requirements needs an agreed scope.
Contact
Start with something specific: the requirement you just received from a customer or your insurer, or the incident you want to avoid.