Regulation has moved cybersecurity from the IT department to the boardroom. NIS2 requires management bodies to approve and oversee cybersecurity risk-management measures; DORA sets detailed requirements on ICT risk, testing and third-party providers for the financial sector; and customers and public tenders increasingly ask for ISO 27001 or, in the Spanish public sector, ENS conformity. Many organisations respond with documents written to pass an audit that do little to reduce risk.
ZERYON takes the opposite approach. We start from your real risks and obligations, map them against the frameworks that apply to you and build a single programme in which each control serves both security and compliance. We write what needs writing, implement what needs implementing and, through our vCISO service, provide the ongoing leadership that keeps the programme alive between audits.
What's included
Applicability and gap analysis
We determine which frameworks apply to you, whether NIS2, DORA, ISO 27001, ENS, GDPR, PCI DSS, SOC 2 or NIST CSF, and measure your current position against each requirement.
Risk assessment and roadmap
A risk-based plan that prioritises controls by impact and effort, with owners, milestones and budget estimates, including the security of critical suppliers.
Policies and procedures
Information security policy, incident management, business continuity, supplier security and the rest of the documentation, written to be used rather than filed.
Certification and audit support
Preparation for ISO 27001 certification or ENS conformity (self-assessment or certification, depending on the system's category): statement of applicability, internal audit, management review and support during the external audit.
vCISO (CISO as a Service)
An experienced security leader working part-time with your organisation to run the programme, report to the board and coordinate teams and suppliers.
How we work
Understand
We review your business, regulatory scope, existing controls and documentation, and interview the key people.
Diagnose
We deliver a gap analysis and risk assessment with clear priorities, explained in terms your management can act on.
Implement
We build or adapt policies, processes and technical controls with your teams, reusing what already works.
Sustain
We track progress, prepare audits and management reviews, and keep the programme current as regulation and risks change.
What you get
One programme, several frameworks
A single set of controls mapped to all your obligations, without duplicated effort.
Board-ready reporting
Clear indicators and reports that help management fulfil its oversight responsibilities.
Audits without surprises
Documentation and evidence organised before the auditor arrives.
Security that improves
Controls chosen because they reduce real risk, not just because they tick a box.
Who it's for
- Essential and important entities within the scope of NIS2.
- Banks, insurers, investment firms and other financial entities subject to DORA, and their ICT providers.
- Companies pursuing ISO 27001 certification to win customers or tenders.
- Suppliers to the Spanish public sector that need ENS conformity.
- Organisations without a full-time CISO that need security leadership.
Frequently asked questions
Does NIS2 apply to my organisation?
NIS2 applies to medium-sized and large organisations operating in the sectors listed in its annexes, such as energy, transport, banking, health, digital infrastructure and certain manufacturing, among many others, and to some specific entities regardless of size. The exact scope depends on national transposition, so we analyse your case against the law that applies to you.
What is DORA and who does it affect?
The Digital Operational Resilience Act is an EU regulation that has applied since 17 January 2025. It requires financial entities, including banks, insurers, investment firms, payment institutions and crypto-asset service providers, to manage ICT risk, report major ICT-related incidents, test their resilience and control their ICT third-party providers. Critical ICT providers to the sector can also come under direct EU oversight.
How long does ISO 27001 certification take?
It depends on the scope, the size of the organisation and how mature its security already is. After a gap analysis we can give you a realistic plan. What we never do is promise a certification result: that decision belongs to an independent certification body.
What is the difference between ISO 27001 and ENS?
ISO 27001 is an international standard for information security management systems, certified by accredited bodies and valid in any sector. The ENS (Esquema Nacional de Seguridad) is Spanish regulation that applies to the public sector and to the companies that supply it with services and systems. They share much of their logic, and a well-designed programme can address both.
What does a vCISO do?
A virtual CISO provides security leadership without a full-time hire: setting strategy, prioritising investment, reporting to the board, coordinating audits and incident readiness, and acting as the security point of contact for regulators and customers.