Cybersecurity consultancy in Móstoles: compliance and governance

• For compliance, we analyse the gaps, draw up the work plan, write policies, prepare evidence and support you through the audit.
• It takes 3 to 6 months depending on the standard and the size of your company.

Read more Read less

We do not certify: ISO/IEC 27001 or ENS certification is issued by an independent certification body.

The outsourced security lead, or vCISO, sets priorities, runs the security plan, coordinates providers, answers clients and auditors and reports to management. In the first month there is an assessment and a plan, and every quarter progress is reviewed with management.

In general, the NIS2 Directive applies to medium-sized and large companies in the sectors listed in its Annexes I and II, and only in some cases to small ones. As of 6 November 2026, the Spanish law transposing the directive has not been published in the BOE (Spain's Official State Gazette). Under the ENS, the basic category requires a declaration of conformity, which is a self-assessment. The medium and high categories require certification, with an audit by a certification body.

• Compliance: quoted after the assessment, with a fixed written quote within 48 hours.
• vCISO: the price depends on the size of the company and the time commitment, with no minimum term.
• The prices we show do not include VAT (21%).

The compliance service is for companies that sell to the public sector, to large companies or to regulated sectors and are asked to demonstrate their security.

The vCISO suits SMEs that need someone in charge of security but can't justify a full-time position. These are some common reasons to call us:

1. You want to bid for public contracts that require the ENS.
2. You supply a company affected by NIS2 and it is asking you for evidence of how you protect its information.
3. No one in your company has security as their main responsibility.
4. You have several IT and security providers and no one coordinates them.