# Gap analysis with technical implementation.

Source: https://vetosec.at/en/services/gap-analysis/

We check where you stand against ISO 27001, NIS2, GDPR or another framework. Then we show how each gap is closed technically, and implement it if you want.

- **ISO 27001** preparation
- **NIS2** NISG 2026
- **GDPR** Art. 32
- **Implementation** from one source

## Result

What you take away from the gap analysis.

We know the requirement and the server where it gets met. So every recommendation includes the technical way to implement it.

- **As-is versus target**: Every requirement checked against your actual practice and systems.
- **Prioritised action plan**: What comes first, with effort and impact. A basis for management and budget.
- **Technical implementation**: Backup, access, logging, encryption, segmentation, monitoring. We build it instead of only writing about it.
- **Prepare evidence**: Documentation that auditors, authorities or customers understand.
- **Support until the audit**: We prepare you for certification. Only an accredited body may certify.

## Frameworks

Which requirements we work with.

- **ISO/IEC 27001**: Preparing for certification. Implementing and evidencing Annex A controls.
- **NIS2 / NISG 2026**: Risk management, incident handling, supply chain. As an entity in scope or as a supplier.
- **GDPR**: Technical and organisational measures under Art. 32, deletion and access concepts.
- **Other frameworks**: CIS Controls, BSI IT-Grundschutz, DORA in the supply chain or your customer's requirements.

## Process

From first call to implemented measure.

1. **Define scope**: Which framework, which scope, which deadline.
2. **Assessment**: Interviews, documents and a technical review of your systems.
3. **Report and plan**: Gaps, priorities and technical solutions.
4. **Implementation**: Optional: we implement the measures and keep them running.

## Who it is for

When evidence is required.

### A good fit if

- An ISO 27001 certification is planned
- Your company is in NIS2 scope or supplies entities that are
- You process sensitive personal data under GDPR
- A customer demands security evidence

### What we do not do

- No legal advice
- No certification, an accredited body does that

## Open source consulting

We use open source where it makes sense. In consulting we check which of your systems can move, what you save and where a commercial product fits better.

- **Lower running costs**: Virtualisation, firewall, VPN, backup and single sign-on run without licence or subscription fees. You only pay for optional vendor support.
- **Your data stays with you**: Systems run in your server room or in a data centre of your choice in the EU.
- **Independent of vendors**: Open standards and formats. Switching vendor or provider stays possible at any time.
- **A clear recommendation**: You get a list: what is worth moving, what should stay and what each costs.

[Request open source consulting](https://vetosec.at/contact/?anlass=open-source)

## Further reading

- [**NIS2 for Suppliers: What You Need to Know**](https://vetosec.at/en/articles/nis2/nis2-fur-lieferanten-was-sie-wissen-mussen/): What customers will ask for and which defensible security evidence suppliers should prepare now.
- [**Liability Under NIS2: Geschäftsführerhaftung and Legal Risks**](https://vetosec.at/en/articles/nis2/nis2-haftung-geschaeftsfuehrer/): What company leaders should keep in view when managing cybersecurity, ownership and key risks.
- [**Server absichern: Warum ein Standard-Server nicht mehr reicht**](https://vetosec.at/en/articles/cybersecurity/warum-standard-server-nicht-reicht/): A freshly installed server is set up for convenience.

## Frequently asked questions

### What does a gap analysis cost?

It depends on framework, scope and existing documentation. After the first call you get a quote with fixed scope and timeline.

### Do you certify to ISO 27001?

No. We prepare you and implement the measures. An accredited certification body issues the certificate.

### Does it help with GDPR?

Yes, for the technical part: access control, encryption, logging, deletion and recoverability under Art. 32. Legal assessment stays with your counsel.

### How is this different from the IT Check?

The IT Check reviews your systems against our checklist. The gap analysis reviews against a specific framework and also covers organisation and documentation.

## Related

- [IT Check](https://vetosec.at/en/services/it-check/): from €1,299
- [NIS2](https://vetosec.at/en/compliance/nis2/): duties and supply chain
- [Ongoing support](https://vetosec.at/en/services/it-support/): fixed monthly price

## Gap analysis, ISO 27001 preparation and GDPR implementation in Austria

A gap analysis compares the current state of information security against frameworks such as ISO/IEC 27001, NIS2, GDPR, CIS Controls, BSI IT-Grundschutz or DORA.

Typical measures include access control with MFA, central logging, segmentation, encryption, tested backup, patching and an incident plan.

Updated: October 19, 2026

Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/