Services
Onboarding, gap analysis, remediation, vCISO, internal audit and training, by the EVIDEVO team or partners.
Cybersecurity and compliance specialists work alongside EVIDEVO. They handle onboarding, remediation and ongoing management, and everything they do stays in the platform: evidence, decisions, deadlines.
Platform
EVIDEVO holds frameworks, controls, owners and evidence, and handles the work that is the same for every organisation.
Services
The work that needs judgement, experience or sign-off, carried out by the EVIDEVO team or partner consultants.
Packages
Platform and services combined around a goal: NIS2 remediation, ISO/IEC 27001 certification, ongoing management.
Getting started
Getting-started services: set-up, gap analysis, remediation, readiness and migration.
- EVIDEVO or partner
Platform onboarding
Scope set-up, import of existing policies and controls, key integrations, user training.
In the platformControls, owners and deadlines configured for the scope.
- EVIDEVO or partner
Gap analysis
A measure-by-measure comparison of what the framework requires and what is in place: scope, the organisation's category, gaps and priorities. More in-depth than the starting assessment.
In the platformThe starting point, measure by measure.
- EVIDEVO or partner
Remediation
Treatment plan, policies and procedures, first evidence. Tasks are assigned to the people who will maintain them.
In the platformAssigned tasks, with owner and deadline.
- EVIDEVO team
ISO/IEC 27001 readiness
Management system, statement of applicability, internal audit and management review, up to the certification audit.
In the platformStatement of applicability linked to controls.
- EVIDEVO team
Migration
From spreadsheets or other tools: controls, evidence and policies are brought into EVIDEVO without losing history.
In the platformExisting controls, evidence and policies, imported with their history.
Ongoing management
Ongoing services: vCISO, managed compliance, internal audit, incidents, training, vendors.
- EVIDEVO or partner
vCISO
An external security lead on an agreed engagement: programme, priorities, liaison with the management body and vendors.
In the platformManagement body reports generated from platform data.
- EVIDEVO team
Managed compliance
The specialist team keeps evidence, vendors and periodic reviews in order on behalf of the organisation. Decisions stay with the organisation.
In the platformPeriodic reviews on record, exceptions flagged.
- EVIDEVO team
Internal audit
Periodic NIS2 or ISO/IEC 27001 audit and support during the certification body's audit. The auditors are not the people who carried out the remediation.
In the platformFindings and corrective actions linked to controls.
- EVIDEVO team
Incident support
Agreed availability to classify an incident and prepare notifications within NIS2 timelines: 24 hours, 72 hours, one month.
In the platformIncident timeline and notifications documented.
- EVIDEVO or partner
Training
For management bodies, as NIS2 art. 20 requires; AI literacy for staff, as AI Act art. 4 requires; awareness for teams.
In the platformAttendance and completion recorded as evidence.
- EVIDEVO or partner
Vendor campaigns
Questionnaires, reminders and assessment of critical vendors, with the results in the register.
In the platformVendor register assessed and current.
Packages
Three packages that combine platform and services in a single proposal.
For organisations that prefer to start from a goal: platform and services combined in one package, with a single proposal.
NIS2 remediation
Gap analysis, remediation and platform, through to measures that are in place and documented. After the first year, the platform and any services still needed continue.
- Gap analysis
- Remediation
- Platform onboarding
- Compliance calendar
Towards ISO/IEC 27001 certification
Readiness, internal audit and support during the certification body's audit. The organisation chooses the certification body.
- Management system
- Statement of applicability
- Internal audit
- Audit support
Ongoing management
A vCISO working in EVIDEVO, periodic internal audits and reviews with the management body.
- vCISO
- Periodic internal audit
- Management body reporting
- Incident support
Services and packages are defined by the frameworks in scope, the size of the organisation and the starting point. This is also covered in the presentation.
Who delivers the services
The EVIDEVO team, and the consultants who work with the platform.
The EVIDEVO team brings together cybersecurity, compliance and audit expertise, and delivers directly the services that require specific qualifications or accountability: audit, certification readiness, managed compliance, incident support.
Onboarding, assessment, remediation, vCISO and training can also be delivered by partner consultants who use EVIDEVO with their own clients. An organisation referred by a consultant stays with that consultant.
What the services do not do
- They do not issue certifications: certification is issued by the accredited body the organisation chooses.
- They do not replace the decisions of the management body, which remains accountable for the measures.
- They are not legal advice: where needed, legal opinions remain with the organisation's counsel.
A thirty-minute presentation based on the organisation's scope.
It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.