Service 01
Cyber Security Framework Consulting
Implement ISO 27001, NIS2, DORA, PCI DSS and GDPR with one control set, expert guidance and AI-generated documentation, from first gap assessment to audit day.
- Home
- Cyber Security
Framework consulting + vCISO
Cyber Security
Get compliant. Stay secure. Lead with confidence.
Two services for organisations facing ISO 27001, NIS2, DORA, PCI DSS or GDPR: hands-on consulting to implement the framework, and a virtual CISO to lead your security programme without the cost of a full-time hire.
Frameworks we support
- ISO 27001
- NIS2
- DORA
- PCI DSS v4.0.1
- GDPR
One control set, mapped across all five.
Our two cyber security services
Service 02
vCISO
Senior security leadership for organisations without a dedicated CISO. Your virtual CISO leads the programme and reports to your board, on a flexible retainer.
Service 01
Cyber Security Framework Consulting
From first gap assessment to audit day, we help you meet the standards your regulators, customers and insurers expect. You get experienced consultants, a proven method and an AI-native platform that does the heavy lifting.
Implement a control once, evidence it once, and reuse it across every framework that applies to you.
- 5frameworks covered by one control set
- 93ISO 27001 Annex A controls mapped
- 35+policies and procedures tailored to you
- 2–3 weeksto audit-ready with CogniRes, versus 6–18 months by the traditional route
Frameworks we support
Every framework, one programme
Each has its own rules and its own audience, but they share most of the same controls and evidence. We build them as one programme, not separate projects.
International standard
ISO/IEC 27001:2022
The international benchmark for information security, demanded by enterprise clients, public tenders and cyber insurers.
- 93Annex A controls
- 4control themes
- Annualsurveillance audits
- Who it's for
- Any organisation, in any sector, that needs to prove its security to others.
- How we help
- Scope, asset register, risk assessment, Statement of Applicability, policies, internal audit, management review, and support through your Stage 1 and Stage 2 audits.
EU directive · Cyprus law
NIS2
Mandatory cyber security rules for 160,000+ EU entities, across sectors including transport, energy, health and ICT services. In Cyprus, the Digital Security Authority supervises.
- 6 hoursearly warning in Cyprus (24 hours in the EU directive)
- 72 hoursincident notification
- 1 monthfinal report
- What's at stake
- Management must approve the measures, complete training and can be held liable. In Cyprus, fines reach €10M or 2% of global turnover for essential entities, and €7M or 1.4% for important ones.
- How we help
- Scoping and classification, Article 21 gap analysis, incident playbooks built around the local deadlines, supplier security, business continuity and management training.
EU regulation · Finance
DORA
Digital operational resilience for EU financial entities, and for the ICT suppliers they rely on. Regulation (EU) 2022/2554 has applied since January 2025.
- 4 hoursinitial notification, once classified as major
- 72 hoursintermediate report
- 1 monthfinal report
- Who it's for
- Banks, insurers, payment institutions, crypto-asset providers and the ICT providers that serve them.
- Reporting obligation
- Major ICT incidents must be reported to your competent authority, such as the Central Bank of Cyprus. See what is required.
- How we help
- ICT risk framework and categorisation, incident classification and reporting, Register of Information, subcontracting-chain oversight, resilience test plans and management-body governance. Your ISO 27001 and NIS2 work is reused, not repeated.
Payment card standard
PCI DSS v4.0.1
The security standard for any business that stores, processes or transmits payment card data, from hotels and retailers to payment service providers.
- 12core requirements
- Mar 2025fully effective
- Annualvalidation by SAQ or ROC and AOC
- Who it's for
- Merchants and service providers that handle cardholder data.
- How we help
- Cardholder data environment scoping, gap analysis, TPSP responsibility matrix, a scan and test calendar, and preparation for your QSA assessment.
EU regulation · Data protection
GDPR
Every organisation handling personal data of people in the EU must prove it is processed lawfully and kept secure. In Cyprus, the Commissioner for Personal Data Protection supervises.
- €20Mor 4% of global turnover, the maximum fine
- 72 hoursto notify a reportable personal data breach
- Art. 30records of processing activities
- Who it's for
- Any organisation that processes personal data of people in the EU, whatever its size or sector.
- How we help
- Data mapping and records of processing, data protection impact assessments, data-subject request handling, breach assessment, processor and supplier checks, and Article 32 security mapped to the ISO 27001 controls you already hold.
Coming next
On the CogniRes roadmap
Built on the same controls, evidence and AI engine, so each new framework is an extension rather than a new project.
- ISO 27701privacy information management
- ISO 42001AI management system
- CRACyber Resilience Act, product security
- SOC 2Trust Services Criteria
In active development. Timing may change.
DORA reporting
Reporting to your central bank
Article 19 of DORA (Regulation (EU) 2022/2554) requires financial entities to report every major ICT-related incident to their competent authority. For banks, payment institutions and e-money institutions in Cyprus, that is the Central Bank of Cyprus. In many other EU countries it is also the national central bank.
| Report | What and when | Legal basis |
|---|---|---|
| Initial notification | Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. | DORA Art. 19(4)(a) Reg. (EU) 2025/301, Art. 5 |
| Intermediate report | Within 72 hours of the initial notification, then updated when the status changes and once regular activities are recovered. | DORA Art. 19(4)(b) Reg. (EU) 2025/301, Art. 5 |
| Final report | Within one month of the latest intermediate report, with the root cause and the actual impact. | DORA Art. 19(4)(c) Reg. (EU) 2025/301, Art. 5 |
| Register of Information | Reporting on your ICT third-party arrangements at least yearly, on the date your authority sets, and the full register on request. | DORA Art. 28(3) Reg. (EU) 2024/2956 |
| Annual costs and losses | An estimate of the costs and losses caused by major ICT incidents, when your authority requests it. | DORA Art. 11(10) |
What counts as a major incident is set by Delegated Regulation (EU) 2024/1772, and the report templates by Implementing Regulation (EU) 2025/302. Clients must also be told without undue delay if a major incident affects their financial interests (Art. 19(3)).
Who receives the reports in Cyprus
Central Bank of Cyprus
Banks, payment institutions and e-money institutions. Significant banks report through the national authority, which immediately passes the report to the ECB.
CySEC
Investment firms, crypto-asset service providers and other firms supervised by the Cyprus Securities and Exchange Commission.
Superintendent of Insurance
Insurance and reinsurance undertakings.
How we help. We set up your classification criteria, incident playbooks, report templates and Register of Information, so your team can meet the clock from day one. Article 19(5) allows reporting to be outsourced, but your organisation remains fully responsible for it.
Where to start
Which frameworks apply to you?
- Banks, insurers, payment and crypto firmsDORAISO 27001PCI DSSGDPR
- ICT and managed service providersNIS2ISO 27001DORA, as a supplierGDPR
- Shipping and logisticsNIS2ISO 27001GDPR
- Energy, health and other critical sectorsNIS2ISO 27001GDPR
- Hotels, retail and e-commercePCI DSSGDPRISO 27001
Indicative only. Scope depends on your size, sector and activities, so we confirm it in your first assessment.
One control. Many frameworks.
Implement once and evidence once. Here is how a single policy maps across all five, which is why a second framework is an extension rather than a new project.
Access-control policyOne policy, one set of evidence
- ISO 27001:2022
A.5.15 - NIS2 Directive
Art. 21(2)(i) - DORA
Art. 9 - GDPR
Art. 32 - PCI DSS v4.0.1
Req. 7
How we work
Six phases, from scope to audit
Start with a gap assessment, or hand us the full implementation. The route is the same either way, and AI handles the heavy lifting at every phase while you review and approve.
Scope
Define boundaries, locations, services and processes, and confirm which frameworks apply.
Assets
Build your asset inventory, with owners assigned and confidentiality, integrity and availability rated.
Risks
Assess each asset against threats, score likelihood and impact, and agree treatment plans and risk owners.
Controls
Map the 93 Annex A controls, set applicability and produce your Statement of Applicability.
Policies
Tailor 35+ policies and procedures, then manage review, approval and communication.
Audit readiness
Fill the evidence pipeline, run the internal audit and corrective actions, and support you through the audit.
It doesn't stop at the audit. We can keep you compliant all year with management reviews, internal audits, evidence collection, risk and policy reviews, and surveillance audit support.
Our experience and solutions
Consultants who built their own platform
We turned decades of hands-on experience into CogniRes, the AI-native ISMS platform our team built. You get expert judgement and working software, not a stack of templates.
- Decades of experienceIn business strategy, IT and telecoms, where uptime, regulation and security are everyday concerns.
- Consulting depthArchitecture, data management, software evaluation and GDPR are long-standing parts of our practice.
- EU and Cyprus focusBased in Nicosia, working to EU regulation and to the stricter local NIS2 reporting deadlines.
- Independent by designWe prepare you and stand beside you at audit. Accredited bodies and QSAs do the assessing.
CogniRes
Live in productionAn AI-native ISMS that generates your documentation from your real organisational data. Not templates. Yours.
- AI-generated ISMSAsset register, risk assessment, Statement of Applicability and 35+ policies, delivered as Word documents.
- Dedicated framework modulesNIS2 incidents, DORA Register of Information, GDPR records and PCI DSS scoping, on one control set.
- Cited AI assistantAnswers grounded in 94 ISO standards, with the source shown so they stand up in front of an auditor.
- Compliance all yearEvidence pipeline, deadline monitors, supplier scoring, internal audit and management review.
- Full data sovereigntyEU data hosting, with a self-hosted option for regulated sectors.
- 5frameworks live
- 11k+ISO knowledge vectors
- 27production workflows
Every AI output is labelled and reviewed by you before use.
Service 02
vCISO
Senior security leadership, without the full-time hire.
A virtual CISO is an experienced security leader who joins your team part time. Most SMEs have no in-house security specialist, yet regulators and customers now expect someone to own the programme. Your vCISO guides your framework implementation, owns the roadmap and reports to your board.
- Lower costExecutive expertise on a retainer, without a full executive package.
- Faster startBegin once scope is agreed, without a long executive search.
- Flexible commitmentMore hours during implementation, fewer once you are running.
What your vCISO does
Strategy and roadmap
Assess your security posture against your chosen framework, then agree a prioritised plan and budget.
Framework implementation
Lead your ISO 27001, NIS2, DORA or PCI DSS programme from scope to audit, coordinating your teams and suppliers.
Risk and compliance
Maintain the risk register and treatment plans, policies, supplier due diligence and audit evidence.
Board reporting
Report risk and progress in business language, support management reviews and deliver management training.
Incident readiness
Build response plans and run tabletop exercises, so your team knows who does what when the reporting clock starts.
Team and culture
Raise awareness, mentor your IT staff and, when the time comes, help you hire and hand over to a permanent CISO.
Regulatory reporting to your central bank
For financial entities, your vCISO runs DORA reporting under Article 19: classifying major ICT incidents and preparing the initial notification, intermediate and final reports for your central bank or other competent authority, and keeping the Register of Information and annual cost and loss estimates ready. DORA allows reporting to be outsourced, but your organisation remains fully responsible, so we work to a sign-off process agreed with your management. See the full requirements.
- 4 hoursinitial notification, once classified as major
- 72 hoursintermediate report
- 1 monthfinal report
Compare
vCISO or dedicated CISO?
Both are valid. The right choice depends on your size, your risk and how much day-to-day leadership you really need.
| What matters | vCISO | Dedicated CISO |
|---|---|---|
| Cost | A monthly retainer sized to the hours you need, with no recruitment fees, bonus or benefits. | A full executive package: base pay from around €100k in Western European markets*, plus bonus, pension and recruitment fees. |
| Time to start | As soon as scope is agreed. | Often a long search, as experienced CISOs are in short supply. |
| Experience | Lessons from many organisations, sectors and audits. | Deep knowledge of one organisation, built over time. |
| Flexibility | Scale hours up for an audit or project, then back down. | A fixed, permanent role, whatever the workload. |
| Day-to-day presence | Agreed hours, remote and on site. Needs an internal contact to keep work moving between sessions. | Embedded in the team and in daily decisions. |
| Perspective | An objective outside view, free of internal politics. | An insider's view, with close relationships across the business. |
| Best fit | SMEs and mid-sized organisations, first-time compliance, or a gap between hires. | Large security teams, complex risk and constant regulator contact. |
*Indicative 2026 recruiter benchmarks for smaller companies in Western Europe, before bonus and benefits. Costs vary by country and company size.
Governance
Where your vCISO fits in each framework
Every framework says something about who is responsible for security. Here is what each one expects, and where a vCISO helps.
| Framework | What it expects of leadership | How your vCISO helps |
|---|---|---|
| ISO 27001 Clause 5.3 | Top management assigns who ensures the ISMS conforms and who reports on its performance. No specific job title is required. | Handles the day-to-day ISMS work and performance reporting, under a role formally assigned by top management. |
| NIS2 Art. 20, Cyprus law | Management approves and oversees the measures, follows training and can be held liable. | Prepares the measures for approval, reports on progress and delivers management training. |
| DORA Art. 5, 6 and 19 | The management body holds ultimate responsibility. Entities other than microenterprises need an independent ICT risk control function. Major ICT incidents must be reported to the competent authority, such as your central bank. | Supports your ICT risk framework and your management body, and prepares incident reports and the Register of Information for your central bank or other authority. We agree with you how the control function is set up, so independence is preserved. |
| PCI DSS Req. 12.1.4 | Responsibility is formally assigned to a CISO or a knowledgeable member of executive management. | Advises your named executive, prepares for the QSA assessment and keeps the testing calendar on track. |
| GDPR Art. 5(2), 32 and 33 | You must be able to demonstrate compliance, keep personal data secure and notify reportable breaches to the regulator within 72 hours. | Keeps security aligned with data protection, supports breach assessment and works alongside your Data Protection Officer if you have one. |
A vCISO carries the workload, not the accountability. Responsibility stays with your management. Your vCISO gives them the advice, evidence and reporting they need to meet it.
How it works
From first assessment to ongoing leadership
Assess
Review your current posture, risks and obligations against the frameworks that apply.
Plan
Agree a prioritised roadmap, the budget and the hours you need.
Lead
Your vCISO runs the programme, works with your teams and suppliers, and reports to the board.
Evolve
Continue, scale up or down, or hand over to a permanent hire when you outgrow the model.
Better together. Framework consulting gets you compliant, your vCISO keeps the programme alive, and CogniRes holds it all in one place.
Questions
Good to know
Can Analytical Solutions certify us?
No, and that is by design. ISO 27001 certificates are issued by accredited certification bodies, and PCI DSS is validated by a Qualified Security Assessor or by self-assessment. We prepare you and support you during the audit, so the result stays independent.
Can we get certified for NIS2 or DORA?
NIS2 and DORA are legal obligations rather than certificates: you show compliance to your supervisor. ISO 27001 gives you a strong head start because much of the evidence can be reused, but it does not make you compliant on its own.
How quickly can we be audit-ready?
With CogniRes, in as little as 2 to 3 weeks, compared with 6 to 18 months by the traditional route. The real timeline depends on your scope, your starting point and how quickly your team can review and approve. Audit dates depend on your certification body or assessor.
How much of a vCISO's time will we need?
It depends on your size and stage. We size it after the first assessment, usually with more hours during implementation and fewer once the programme is running.
Insights
Reading on cyber security
vCISO or full-time CISO? How to choose
Regulators and customers now expect someone to own security. Here is how to decide whether that person should be full time, part time or both in turn.
DORA incident reporting: what you owe your central bank, and when
A major ICT incident starts a clock of three reports to your competent authority. Here is the legal basis, the deadlines and what to have ready before you need it.
NIS2 in Cyprus: why your incident plan needs a six-hour clock
The EU directive allows 24 hours for an early warning. Cyprus allows six. If your incident plan was written from the EU text, it may already be out of date.
Not sure which service you need?
Tell us your sector and size. We'll confirm which frameworks apply and whether consulting, a vCISO or both make sense for you.