01
Purpose and scope
In a short workshop, we discuss the organisation, critical services, customer requirements and audit purpose. We identify requirements that need confirmation with the people responsible for interpreting them.
Compliance and regulations
IT compliance
We help connect IT requirements with practical work, responsibilities and audit material. Legal obligations, customer requirements, certification preparation and our TrustGuard programme are separate matters. We agree the scope for each organisation; the service is not a guarantee of compliance.
Trusted by
Companies and institutions that need stable IT.
From requirements to planned work
This is a starting point for management, IT, compliance, legal and internal audit teams. We first identify the goal, critical services and available materials. The regulations, standards and programmes listed are not equivalent obligations for every company; applicability and scope are assessed for each organisation.
Reviews and audit preparation
Choose the area that matches your needs. A NIS2 audit does not replace every other review, and an ISO gap assessment is not formal certification.
NIS2 audit
Review of relevant requirements, safeguards, incidents, suppliers, business continuity and management responsibilities.DORA audit
Review of ICT risk, digital resilience, suppliers, incidents, testing and documentation in the financial sector, within the scope relevant to the organisation.ISO 27001 gap assessment
Review of gaps in the information security management system, policies, risk registers, roles and reviews before certification.IT audit for KSB 315
IT controls, applications, access, changes, financial systems, reports and material for the financial statement audit.Virtline's own certificate
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity. It certifies our management system, not the customer's organisation or the compliance of its IT environment.
View Virtline's certificateHow the compliance project runs
We can begin with a review or use an existing report. Assessment, decisions, implementation and ongoing support each have a separately agreed scope.
02
Current position
We review controls and records, identifying gaps, risks and decision owners. We also examine contracts, SLAs, subcontractors and service dependencies on suppliers.
03
Plan and delivery
We agree priorities, budget, deadlines and acceptance criteria. Commissioned work may cover policies, technical safeguards, registers, training and configuration improvements.
04
Review and maintenance
We check the results of the agreed work and completeness of the material. Further reporting, access reviews, testing and documentation updates are planned with your IT team or as separate support.
Practical scope
What your organisation receives
Deliverables depend on the selected review or implementation. Documentation should describe work actually performed, including gaps and limitations.
Requirements linked to controls and systems, a gap register, business impact, likelihood and service criticality. Each recommendation has a reason, priority, owner and proposed deadline.
Urgent fixes, management decisions, technical work, supplier dependencies and budget needs. Completed work, open tasks and risks accepted by authorised people are identified separately.
Procedures, configurations, logs, monitoring reports, recovery test results, access reviews, incident registers, decisions and acceptance records. A file or declaration alone does not establish that a control is effective.
Roles for management, system owners, IT, compliance and suppliers, acceptance criteria and a way to confirm completion. We also agree reviews and documentation updates.
Records must reflect actual practice
A procedure without configurations, logs or tests can leave gaps in a control assessment. Planning covers privileged access, MFA, backup and recovery, monitoring and incident escalation, Microsoft 365, Active Directory and device settings, and supplier oversight. Each area needs an owner and reviews. For AI, the scope covers system classification, data risks, information flows, documentation and operating rules. Shared work can support several requirements, but does not remove differences in their scope. The company remains responsible for its decisions and obligations. Preparing records does not replace an auditor's assessment or the independent decision of a certification body.
CRA and product cybersecurity
The Cyber Resilience Act concerns products with digital elements. Gap assessment and implementation of safeguards and vulnerability handling processes help prepare the product and its documentation for the applicable conformity assessment.
Programmes and implementation
Further routes once the purpose and gaps are clear. Each has its own scope and is not automatically part of every audit.
-
AI Act
AI system classification, data risks, responsibility, documentation and secure operation. Requirements and deadlines must be established for the particular use and the company's role.
-
TrustGuard
Our own programme for audit firms and professional services firms: levels, security practices, documentation and customer communication. It does not replace ISO certification or legal obligations.
-
NIS2 implementation
Planning and delivery of agreed policies, procedures, technical safeguards, registers and maintenance arrangements.
-
DORA implementation
ICT risk management, supplier oversight, resilience testing, incidents, response scenarios and reporting.
Safeguards and ongoing support
We connect requirements with work in your IT environment. Tools, integrations and maintenance are agreed separately; buying a solution does not establish compliance.
-
Cybersecurity
Audits, tests and safeguards to examine the technical basis of procedures and address identified gaps.
-
SOC, SIEM and SOAR
Event monitoring, alert correlation and response scenarios. Tools and operational support require an agreed scope.
-
Backup and recovery
Retention, recovery tests and backup resilience against ransomware. We agree acceptable data loss (RPO) and recovery time (RTO).
-
MFA and access
Additional sign-in verification for accounts, VPN, Microsoft 365 and critical applications, with privileged-access rules.
-
EDR, MDR and XDR
Threat detection, response, alerts and escalation. We distinguish endpoint protection, managed response and information combined from different sources.
-
Microsoft 365
Identity, email, data sharing, retention, security settings and access reviews.
-
IT outsourcing
Agreed implementation and maintenance of safeguards, procedures, reporting and recurring reviews.
Questions about IT compliance
Should we start with an audit or implementation?
+
If the requirements and gaps are unclear, we begin with a workshop or an appropriate review. If you already have a report, we can agree a specific implementation, owners, deadlines and acceptance material. We do not direct every type of audit to NIS2.
Can several areas share one plan?
+
Yes. Access, backups, monitoring, incidents, suppliers, roles and reviews often serve several purposes. We map them to relevant requirements while distinguishing regulations, the ISO 27001 standard, an audit under KSB 315 and our TrustGuard programme. One control does not establish that every requirement is met.
Does a review provide certification or confirm compliance?
+
Not by itself. An ISO 27001 gap assessment helps assess readiness; formal certification requires a separate assessment. KSB 315 material supports the statutory auditor's work but does not replace their judgement. Our ISO certificate concerns Virtline. Obligations, deadlines and their interpretation must be established for the specific company; IT services do not guarantee compliance.
Can you help after the audit?
+
Yes. Within an agreed scope, we can implement MFA, backups, monitoring, EDR/MDR/XDR, Microsoft 365 and Active Directory settings, policies, registers and training. Further reporting, reviews and record updates need agreed responsibilities and support arrangements. A report does not remove risk, and recording an exception does not fix it.
Agree the right scope
Describe the audit purpose, regulation or customer requirement, key systems and reports you already have. We will suggest a first step: a workshop, review, action plan, implementation or organising the material.
Discuss your requirements