Security your board can stand behind
NIS2 has made cybersecurity a management responsibility. We help you decide what to protect first, put the right controls in place and keep dated evidence that they work.
Cybersecurity is now a board matter
Since the Belgian NIS2 law came into force in October 2024, management bodies must approve security measures, oversee them and be trained. Financial entities also answer to DORA, while ransomware keeps looking for the weakest link.
Accountability at the top
Directors can be held liable when obligations are not met. They need a picture they can act on, not a technical report they cannot read.
Deadlines that do not wait
A significant incident must be flagged to the CCB within 24 hours. Who decides and who notifies is settled in advance, not on the night itself.
Risk that arrives through suppliers
Service providers, software and shared accounts are part of your attack surface, and NIS2 expects you to manage them as such.
What we do
Risk analysis and awareness
We map what is critical to your business, rank the threats, and train your staff to spot the phishing and fraud attempts aimed at them.
Application security
Authentication, access rights, secrets management and supplier integrations: sound practices built into your applications from the design stage.
Regulatory support
NIS2, CyberFundamentals, DORA, ISO 27001 readiness: we turn the texts into a prioritised plan, concrete measures and documented evidence.
Verification
We test that protections actually hold, including that what must be refused is refused, and we record each result with its date.
Expertise & technologies
- Entra ID, OAuth/JWT and app roles
- Zero-trust API gateways
- Secrets in Azure Key Vault
- Automated certificate management
- Supply-chain checks in CI/CD
- ISO 27001 readiness
- NIS2 and CyberFundamentals
- Negative testing of access controls
How we work
- 01
Secure by default
Everything is protected by default. Every exception is declared, justified and has a named owner.
- 02
Early in the project
Security checks happen before testing starts, when a fix costs a conversation rather than a rebuild.
- 03
Proven and dated
A control counts only once it has been verified. We document the evidence, so you can show it rather than assert it.
What changes for your management
A clear view for the board
Risks ranked in business terms and decisions on record, so management can show it approved and oversaw the measures.
Evidence ready before it is requested
Policies, controls and test results filed and dated, ready for an auditor, an assessment body, a regulator or a client questionnaire.
A team that knows what to do
Roles, escalation and notification steps agreed in advance, so a serious incident is handled with method rather than improvised.
Call us when
- You are unsure whether NIS2 applies to you, or in which category
- Your board is asking for a clear answer on cyber risk
- A conformity assessment or ISO 27001 audit is coming up
- A major client sends you a security questionnaire
- You need a CISO, but not a full-time one
Two ways to work together
A security expert in your team
A profile who strengthens your security team or secures your projects, up to a part-time CISO (CISO-as-a-Service) who reports to management and steers the programme.
A defined security assignment
A gap analysis against NIS2, CyberFundamentals or ISO 27001, a prioritised action plan and its implementation, on an agreed scope with clear deliverables.
Questions we are often asked
Does NIS2 apply to my organisation?
It depends on your sector and your size. We review the criteria with you and document the reasoning. Even outside its scope, clients who are covered may pass security requirements on to you as a supplier.
Can Keystone certify us?
No, and that is by design. Conformity assessments and certifications are carried out by bodies authorised for that purpose. Our role is to prepare you: measures in place, evidence in order, gaps closed before the assessor arrives.
What does a part-time CISO actually do?
Sets security priorities with management, steers the action plan, reports to the board, holds suppliers to account and acts as point of contact in a crisis. The time commitment is agreed with you and adjusted as your needs change.
We are a financial entity. Do you cover DORA?
Yes. DORA has applied since January 2025, with its own requirements on ICT risk, incident reporting, resilience testing and ICT third-party providers. We link them to your existing measures, so you run one programme rather than two.
What would you show your board tomorrow?
Let's review together what is protected, what is proven, and what is not yet.
