Warning The vulnerabilities PHP2Shell and HTTP2Shell are being heavily exploited right now. Many websites and servers are affected. Please check here first whether you are affected. Am I affected?
Gap analysis · ISO 27001 · NIS2 · GDPR
Gap analysis with technical implementation.
We check where you stand against ISO 27001, NIS2, GDPR or another framework. Then we show how each gap is closed technically, and implement it if you want.
Result
What you take away from the gap analysis.
We know the requirement and the server where it gets met. So every recommendation includes the technical way to implement it.
-
As-is versus target
Every requirement checked against your actual practice and systems.
-
Prioritised action plan
What comes first, with effort and impact. A basis for management and budget.
-
Technical implementation
Backup, access, logging, encryption, segmentation, monitoring. We build it instead of only writing about it.
-
Prepare evidence
Documentation that auditors, authorities or customers understand.
-
Support until the audit
We prepare you for certification. Only an accredited body may certify.
Frameworks
Which requirements we work with.
-
ISO/IEC 27001
Preparing for certification. Implementing and evidencing Annex A controls.
-
NIS2 / NISG 2026
Risk management, incident handling, supply chain. As an entity in scope or as a supplier.
-
GDPR
Technical and organisational measures under Art. 32, deletion and access concepts.
-
Other frameworks
CIS Controls, BSI IT-Grundschutz, DORA in the supply chain or your customer's requirements.
Process
From first call to implemented measure.
-
Define scope
Which framework, which scope, which deadline.
-
Assessment
Interviews, documents and a technical review of your systems.
-
Report and plan
Gaps, priorities and technical solutions.
-
Implementation
Optional: we implement the measures and keep them running.
Who it is for
When evidence is required.
✓ Good fit
- An ISO 27001 certification is planned
- Your company is in NIS2 scope or supplies entities that are
- You process sensitive personal data under GDPR
- A customer demands security evidence
✕ What we do not do
- No legal advice
- No certification, an accredited body does that
Open source consulting
We use open source where it makes sense. In consulting we check which of your systems can move, what you save and where a commercial product fits better.
-
Lower running costs
Virtualisation, firewall, VPN, backup and single sign-on run without licence or subscription fees. You only pay for optional vendor support.
-
Your data stays with you
Systems run in your server room or in a data centre of your choice in the EU.
-
Independent of vendors
Open standards and formats. Switching vendor or provider stays possible at any time.
-
A clear recommendation
You get a list: what is worth moving, what should stay and what each costs.
Further reading
-
NIS2 for Suppliers: What You Need to Know
What customers will ask for and which defensible security evidence suppliers should prepare now.
→ -
Liability Under NIS2: Geschäftsführerhaftung and Legal Risks
What company leaders should keep in view when managing cybersecurity, ownership and key risks.
→ -
Server absichern: Warum ein Standard-Server nicht mehr reicht
A freshly installed server is set up for convenience.
→
FAQ
Frequently asked questions
What does a gap analysis cost?
It depends on framework, scope and existing documentation. After the first call you get a quote with fixed scope and timeline.
Do you certify to ISO 27001?
No. We prepare you and implement the measures. An accredited certification body issues the certificate.
Does it help with GDPR?
Yes, for the technical part: access control, encryption, logging, deletion and recoverability under Art. 32. Legal assessment stays with your counsel.
How is this different from the IT Check?
The IT Check reviews your systems against our checklist. The gap analysis reviews against a specific framework and also covers organisation and documentation.
Discuss a gap analysis
Free first call
Briefly describe your situation. We help you assess it and plan the next step. Reply within 24 hours on working days.
Gap analysis, ISO 27001 preparation and GDPR implementation in Austria
A gap analysis compares the current state of information security against frameworks such as ISO/IEC 27001, NIS2, GDPR, CIS Controls, BSI IT-Grundschutz or DORA.
Typical measures include access control with MFA, central logging, segmentation, encryption, tested backup, patching and an incident plan.
office [at] vetosec [dot] at · vetosec.at/contact/