Home / Services

Services

We cover the whole life of a system, from governance and compliance through engineering and testing to operation. You can book each service on its own. In most projects several of them are combined.

01

Governance and compliance

Management systems and regulatory requirements.

Cyber Resilience Act (CRA)

We support manufacturers of hardware and software products in achieving CRA compliance, from product classification and cybersecurity risk assessments to Secure-by-Design implementation, vulnerability handling and reporting, and conformity assessment preparation. By identifying applicable product categories and regulatory requirements early, we help reduce compliance costs, avoid costly redesigns, and ensure security throughout the product lifecycle.

Typical deliverablesCRA product classification, applicability and gap assessment, cybersecurity risk assessment, security requirements, SBOM, technical documentation, and conformity assessment roadmap.

Information Security Management System – ISO/IEC 27001

We design, implement, and continuously improve your ISMS, covering risk assessments, security policies, Annex A controls, internal audits, and certification readiness. By aligning ISO/IEC 27001 with IEC 62443, ISO/SAE 21434, TISAX, NIS2, and DORA where applicable, we streamline compliance, eliminate redundant processes, and reduce long-term management costs.

Typical deliverablesISMS scope, risk treatment plan, Statement of Applicability (SoA), internal audit report, and certification support.

NIS2

We help organizations assess their NIS2 obligations, determine their classification as essential or important entities, and implement effective cybersecurity governance and risk management. From gap assessments and security measures to incident reporting and regulatory documentation, we support compliance while strengthening operational resilience.

Typical deliverablesNIS2 applicability and entity classification, compliance gap assessment, cybersecurity risk register, risk treatment plan, governance framework, incident reporting procedures, remediation roadmap, and regulatory compliance evidence package.

DORA

For banks, insurers, investment firms, payment service providers and their ICT service providers. We cover ICT risk management, the classification and reporting of incidents, the risk from ICT third parties and resilience testing, including threat-led penetration tests (TLPT).

Typical deliverablesGap assessment, ICT risk framework, reporting workflow, remediation roadmap

02

Industrial and product security

Automation systems, plants and connected products.

IEC 62443

We work with all parts of the standard: the secure development lifecycle and the technical security requirements for components (62443-4-1 and 4-2), zones, conduits and security levels for systems (62443-3-x), and security management in operation (62443-2-x). The aim is evidence that holds up in certifications and customer audits.

Typical deliverablesThreat model, security requirements, zone and conduit model, gap analysis

Risk management

We assess cyber risks for OT, IT and products and describe what they mean for the business, for safety and for compliance. The methods follow ISO 27005, IEC 62443 and the TARA of ISO/SAE 21434. Management receives a report it can base decisions on.

Typical deliverablesThreat and risk analysis, risk treatment plan, management report

Penetration testing

We test OT networks, PLCs, HMIs, SCADA systems, engineering workstations, IIoT devices and remote access paths. Tests are coordinated with operations and safety staff and adapted to running production. The report shows how an attacker would actually get in and what to fix first.

Typical deliverablesAttack paths with evidence, impact assessment, prioritised measures

03

Safety and security

Functional safety and where it meets cybersecurity.

Functional safety

We support OEMs and suppliers through the ISO 26262 safety lifecycle: item definition, hazard analysis and risk assessment (HARA), functional and technical safety concept, safety requirements, architecture reviews, verification and the safety case. Our processes fit V-model, agile and hybrid development.

Typical deliverablesHARA, safety goals and ASIL, FSC and TSC, safety case

Safety-security interface

A cyber attack can switch off a safety function or force a system into a hazardous state. We combine hazard analysis with threat modelling and map security measures to safety goals and SIL or ASIL targets, based on IEC 61508, ISO 26262, ISO/SAE 21434 and IEC 62443.

Typical deliverablesCombined hazard and threat analysis, safety-security mapping, safety case addendum

04

Software development

Software with security built in from the start.

Software development

We develop software along a secure development lifecycle based on IEC 62443-4-1, with threat modelling, code reviews and security testing as fixed steps.