You will get NIS2 Readiness Assessment & Compliance Roadmap
Project details
## Project Summary
Prepare your organization for NIS2 compliance with a structured readiness assessment designed to identify cybersecurity gaps, strengthen governance, and prioritize remediation before regulatory enforcement or customer audits.
This service goes beyond a simple compliance checklist. I assess your organization's cybersecurity governance, risk management practices, incident response capabilities, business continuity, supply chain security, and management responsibilities against the NIS2 Directive and Article 21 requirements.
You'll receive a professional assessment including identified gaps, risk-based recommendations, an executive summary, and a practical implementation roadmap. Higher service tiers also include evidence readiness review, governance recommendations, policy review, and executive reporting.
My approach focuses on practical governance, measurable risk reduction, and operational compliance—not generic documentation. Whether you're determining if NIS2 applies to your organization, preparing for regulatory obligations, or strengthening your cybersecurity maturity, you'll receive clear, actionable recommendations tailored to your business.
Prepare your organization for NIS2 compliance with a structured readiness assessment designed to identify cybersecurity gaps, strengthen governance, and prioritize remediation before regulatory enforcement or customer audits.
This service goes beyond a simple compliance checklist. I assess your organization's cybersecurity governance, risk management practices, incident response capabilities, business continuity, supply chain security, and management responsibilities against the NIS2 Directive and Article 21 requirements.
You'll receive a professional assessment including identified gaps, risk-based recommendations, an executive summary, and a practical implementation roadmap. Higher service tiers also include evidence readiness review, governance recommendations, policy review, and executive reporting.
My approach focuses on practical governance, measurable risk reduction, and operational compliance—not generic documentation. Whether you're determining if NIS2 applies to your organization, preparing for regulatory obligations, or strengthening your cybersecurity maturity, you'll receive clear, actionable recommendations tailored to your business.
Target Country
Worldwide, Germany, SpainWhat's included
| Service Tiers |
Starter
$450
|
Standard
$750
|
Advanced
$1,500
|
|---|---|---|---|
| Delivery Time | 5 days | 10 days | 15 days |
Number of Projects | 450 | 950 | 1750 |
General Project Consulting | |||
Define Project Goals | |||
Define Deliverables & KPIs | - | ||
Establish Schedule & Milestones | - | ||
Risk Management | |||
Resource Management | - | - | - |
Budget Management | - | - | - |
Project Reports | |||
Project Diagrams Provided | - | - |
Optional add-ons
You can add these on the next page.
Statement of Applicability (SoA)
(+ 2 Days)
+$350
Evidence Readiness Review
(+ 3 Days)
+$350
Risk Register Development
(+ 3 Days)
+$350Frequently asked questions
About Alejandro
ISO 27001 & NIS2 Consultant | SOC 2 Audit-Ready GRC | Risk Exposure
Granada, Spain - 8:37 pm local time
Preparing for ISO/IEC 27001, SOC 2, NIS2, or DORA should deliver more than policies and documentation; it should establish clear governance, operational controls, measurable ownership, and defensible audit evidence that supports long-term business resilience.
I specialize in designing and implementing cybersecurity governance programs that translate regulatory requirements into practical, sustainable, and audit-ready security operations.
My expertise includes:
• ISO/IEC 27001:2022 implementation, internal audits, and certification readiness
• SOC 2 Type I & Type II readiness assessments
• NIS2 governance and Article 21 compliance
• DORA operational resilience and ICT risk governance
• ENS compliance support
• GDPR and HIPAA security governance
• AI Governance and ISO/IEC 42001 readiness
• Governance, Risk & Compliance (GRC)
Rather than delivering generic document templates, I build governance structures where risks, controls, responsibilities, evidence, and executive reporting are fully connected and capable of supporting real operational environments.
How I can support your organization
• ISO/IEC 27001 Gap Assessments
• ISMS implementation and certification preparation
• Internal Audits
• Statement of Applicability (SoA)
• Risk Assessments and Risk Treatment Plans
• Risk Registers
• SOC 2 Readiness Assessments
• Control Mapping
• Evidence Collection Frameworks
• NIS2 Readiness Assessments
• DORA Gap Assessments
• ICT Risk Governance
• Security Policies and Governance Frameworks
• Third-Party Risk Management (TPRM)
• Vendor Risk Assessments
• Business Continuity Planning (BCP)
• Disaster Recovery Planning (DRP)
• Incident Response Governance
• Executive Dashboards
• KPIs, KRIs and RACI Models
• Fractional vCISO Services
• Security Awareness & Human Risk Programs
• AI Governance Assessments
Selected Experience
• Supported a cloud-first SaaS organization through ISO/IEC 27001 implementation and successful audit preparation, including ISMS development, Statement of Applicability, supplier management, GDPR governance, business continuity, logging controls, internal audit, and evidence management.
• Supported SOC 2 readiness by designing control mappings, evidence frameworks, remediation plans, and audit documentation.
• Developed NIS2-aligned governance programs covering executive accountability, ICT risk management, access governance, supplier security, incident management, and business continuity.
• Designed Human Risk Management programs and phishing awareness initiatives that contributed to reducing phishing exposure by more than 40%.
• Advised executive leadership, CISOs, Compliance Officers, and technology teams on cybersecurity governance, operational resilience, audit readiness, and enterprise risk management.
• Evaluated European cybersecurity and digital innovation projects as an EU Commission Expert Evaluator, assessing technical excellence, governance, implementation quality, impact, risk, and business viability.
What you can expect
-Clearly defined scope and deliverables
-Executive-level communication
-Practical recommendations instead of theoretical reports
-Prioritized remediation roadmap
-Audit-ready documentation
-Traceable control ownership
-Risk-based decision support
-Strong collaboration with technical, compliance, and executive stakeholders
-Measurable governance outcomes
Whether you need a focused assessment, an internal audit, a certification readiness program, a Fractional vCISO, or long-term cybersecurity governance support, I can help your organization strengthen security while meeting regulatory and business objectives.
Let's discuss how I can support your next cybersecurity, compliance, or audit-readiness initiative.
Steps for completing your project
After purchasing the project, send requirements so Alejandro can start the project.
Delivery time starts when Alejandro receives requirements from you.
Alejandro works on your project following the steps below.
Revisions may occur after the delivery date.
NIS2 Scope Assessment
Review your organization, business activities, critical services, and existing cybersecurity documentation to determine the assessment scope and NIS2 applicability.
Governance & Control Review
Assess governance, policies, risk management, incident response, business continuity, supplier security, and management responsibilities against NIS2 requirements.