01
Purpose and requirements
We select the appropriate route, intended recipients and scope. We link requirements to systems, people, documents and records of completed activities.
Certifications, compliance and evidence
Certifications and audit preparation
We help organisations prepare records, review safeguards and plan improvements before an audit. Choose an ISO 27001 gap review, KSB 315 support or TrustGuard for audit firms. Virtline's own certificate is presented separately. It does not certify your organisation.
Trusted by
Companies and institutions that need stable IT.
Start with the purpose
An organisation seeking certification, an audit firm protecting client records and a statutory auditor examining financial statements need different reviews. We start with the recipient's requirements and the systems to be assessed. We identify what works, what is missing and who will decide on improvements.
Audits and programmes
Each route has its own purpose and criteria. NIS2, DORA and contractual requirements are not interchangeable certificates.
ISO 27001 gap review
Review of the information security management system, risks, safeguards and documentation before an external audit.TrustGuard
Virtline's programme for statutory auditors and audit firms, with SILVER, GOLD and PLATINUM levels and annual supervision.KSB 315 audit
IT risks relevant to financial reporting: finance and accounting systems, access, changes, backups, logs and business continuity.IT compliance
Help translating NIS2, DORA, ISO 27001, KSB 315 and client requirements into actions and responsibilities.Virtline's own certificate
Virtline Sp. z o.o. holds certificate PN-EN ISO/IEC 27001:2023-08 issued by TÜV NORD Polska, number AC090 121/2469/6137/2026. The document states validity until 24 February 2029 and covers IT infrastructure, cloud solutions, software integration, audits and security tests, consulting and training. Before using it, check the document, its current status and the scope relevant to the service you are buying. It supports assessment of Virtline as a supplier; it is not your organisation's certificate.
How audit preparation runs
We agree the scope of workshops, review and subsequent work with management, IT and those responsible for requirements and business processes.
02
Environment review
We examine critical systems, access, changes, backups, devices, the network, suppliers and documentation. We check how controls operate.
03
Findings and improvements
We describe gaps by risk and audit impact. We agree priorities, responsibilities and criteria for checking the improvements.
04
Maintenance after changes
We agree a cycle of reviews, reports, tests and documentation updates. Ongoing support and service levels (SLA) are defined in a separate contract.
Practical scope
What the review provides
Assessment scope, criteria, safeguards, responsible people and the status of supporting records. It distinguishes confirmed findings from missing information.
Risks and technical or documentation gaps, with their impact on the audit. Management and IT can see priorities and the difficulty of implementing changes.
Organised backup and recovery-test reports, multi-factor authentication (MFA) settings, account lists, password policies, logs, access reviews and scan results. Organisational material covers decisions, training, incidents, risks and suppliers.
Actions in order of priority, responsible people and acceptance criteria. The requirements, controls, decisions and attachments can be updated for discussions with auditors or clients and for supplier assessments.
ISO gap review scope
The assessment covers the entities, processes, systems, locations, suppliers and data included in the information security management system. We review risks and the Statement of Applicability, which records the selected controls and the reasons for their selection. We examine MFA, backups and retention, permissions, event logging, devices, the network, administration and vulnerabilities. Documentation includes policies, procedures, registers, management decisions, reviews, training, incidents and corrective actions. The result is a plan to address requirements, not a certification decision. Starting before an external audit, after a client's security enquiry or after identifying a gap leaves room to plan the budget and necessary changes.
Related services
Choose a separate scope where the review identifies a need for a closer assessment or ongoing support.
-
NIS2 audit
Assessment of NIS2 requirements within an agreed scope, not a generic package for every certification.
-
Backup and recovery
Data copies, job reports and recovery checks as a separate technical area.
-
Cybersecurity
Security reviews and tests, with help identifying actions after a gap is found or an incident occurs.
-
IT outsourcing
Ongoing administration, monitoring, reviews, reporting and agreed tests after the project.
Questions about audits and certification
Does Virtline's certificate certify the client?
+
No. Certificate PN-EN ISO/IEC 27001:2023-08 covers Virtline's management system. We help clients identify gaps and prepare for their own audit, but the relevant certification body decides whether to award their certificate. Neither our certificate nor the collection of records guarantees that decision.
What does TrustGuard cover?
+
It is Virtline's own programme for statutory auditors and audit firms, not an external ISO standard. It covers confidential records, procedures and GDPR, laptops, media, email, cloud, access, encryption, backups and training. SILVER, GOLD and PLATINUM differ in scope; broader controls may include recurring recovery tests, network threat detection and prevention (IDS/IPS) and risk management. The report, programme decision and annual surveillance audit can support discussions with clients, partners and supervisory bodies, without guaranteeing their acceptance.
How does KSB 315 differ from an ISO 27001 gap review?
+
KSB 315 concerns IT risks relevant to a financial-statement audit. Reviewing ERP and finance systems and general IT controls provides supporting material for the statutory auditor; it does not replace their judgement or responsibility for the audit. An ISO 27001 gap review covers the information security management system and preparation for certification. Both reviews help the audited organisation identify gaps, but use different criteria.
What determines the preparation cost?
+
The purpose, number of systems, scope of records and depth of review. Before starting, we agree whether the work concerns ISO 27001, TrustGuard, KSB 315, NIS2, DORA or contractual requirements. A report and remediation plan do not automatically include implementation of every recommendation or ongoing support; these are agreed separately.
Agree the first step
Tell us whether your enquiry concerns ISO 27001, TrustGuard, KSB 315, NIS2, DORA, client requirements or a supplier assessment. Include the systems involved and any known audit date. We will agree the review scope and materials needed.
Go to contact