The directive is in force, it makes management personally accountable, and inspections come unannounced. Six formats cover the full journey: diagnosis, compliance, suppliers, incident notification, governance, automation.
Six formats following the compliance journey, from diagnosis to incident notification. A partner accountable for the outcome.
14 working days
Are you in scope, and how far from compliant?
8 to 12 weeks
The ten Article 21 measures, deployed and documented.
4 to 8 weeks
The obligation almost nobody has tackled yet.
readiness or activation
Twenty-four hours to raise the alert. That is not improvised.
monthly engagement
The directive makes management personally accountable. We carry the file with you.
4 to 6 weeks
Automate the compliance workload instead of hiring to carry it.
The same formats cover DORA, ISO/IEC 27001 and GDPR, whose requirements overlap heavily with NIS2. Every engagement is scoped before it is priced: perimeter, sequencing and budget are agreed in writing, and do not move afterwards.
The same sequence for every format, with a named owner at each stage.
Exposure assessment, risk mapping, regulatory gap identification.
Control design, technology choices, flow and accountability modelling.
Control deployment, operational documentation delivery, knowledge transfer.
Maintenance, continuous review, long-horizon maturity support.
What people ask us before signing.
With a thirty-minute call to qualify the need. Within fourteen working days you receive a written scope: perimeter, sequencing, costed commitment. Nothing starts before you approve it.
The budget is set at scoping, once the perimeter is known: number of systems, target regulatory level, timeline. You get a firm figure in writing before anything starts, and it does not move afterwards.
That is the most common case. An audit often leads to a compliance programme, then to an ongoing engagement. Each step is scoped separately: you decide on the next one every time, with no cascading commitment.
Yes, across France and remotely. Scoping workshops and strategic reviews happen on site when the context calls for it; the rest is controlled remote work.
Engagements are time-boxed missions. Presidio is the platform we build to steer compliance day to day: risk register, evidence, action plans. An engagement can build on it, but does not have to.
Yes, whenever the stake is real: a NIS2 obligation, a client audit to pass, a process to automate. We would rather say no early than start an engagement that makes no sense for you.
Thirty minutes is enough to decide. If none of these fits, we will tell you so.
Request a call