We build an information security management system (ISMS) to ISO/IEC 27001:2022 that also covers the measures required by NIS2. The team combines a certified lead auditor with more than 350 external audits and an IT/OT systems architect – so we know what the auditor will check and how to implement it in your environment.
Deadline for adopting risk management measures for most essential and important entities in Slovenia.
CRA · reporting already applies fromManufacturers must report actively exploited vulnerabilities and severe incidents within 24 hours. Full application: 11 December 2027.
ISO 9001:2026 · transition byThe new edition has been published; certified organisations must complete the transition.
We take every project to a result you can show: a certificate, compliance that withstands supervision, or a product that meets the CRA requirements.
We build an information security management system that can be maintained in the long term and prepare you for the certification audit.
Scope assessment, risk management measures, procedures for reporting significant incidents, management accountability and training, and evidence for supervision by URSIV.
More on NIS2 →For manufacturers of products with digital elements: product classification, vulnerability reporting process, SBOM, technical documentation and the path to the CE marking.
More on the CRA →Business impact analysis (BIA), strategies, business continuity plans and exercises – stand-alone or as an extension of the ISMS and NIS2 requirements.
More on ISO 22301 →Transition to ISO 9001:2026 or a new implementation, integrated with ISO 27001 and ISO 22301 into one management system.
More on ISO 9001 →Ongoing information security leadership without hiring a CISO, and an annual maintenance cycle for a certified system: risk assessment, internal audit, management review and preparation for surveillance audits.
Projects are led by two experts who combine the experience of a certification auditor with technical knowledge of IT and OT environments.
ISO/IEC 27001 · ISO 22301 · ISO 9001 · ISO 14001 · ISO/IEC 27017 · ISO/IEC 27018 · ISO 50001 and others
Internal auditor for ISO/IEC 27001 and ISO 22301
The certificate is issued by an independent accredited certification body of your choice.
Policies and procedures in Slovenian or English, adapted to your processes – not generic templates.
Vulnerabilities, network segmentation, privileged access and backups – not just documents.
Projects run in five phases; each ends with handed-over deliverables. We use the same framework for ISO 22301 and ISO 9001.
Gap analysis report with an action plan and a defined system scope.
Asset register with owners and valuation, plus a summary of the technical review.
Methodology, risk register, risk treatment plan and Statement of Applicability (SoA).
Policies, rules and procedures ready for management approval.
Training, internal audit, management review and support during the certification audit.
Tool: we keep evidence, registers and the audit trail in our own RegulusAi tool, hosted in the EU. AI helps with drafts; every piece of content is reviewed by an expert and approved by your management.
ISO/IEC 27001, ISO 22301 and ISO 9001 share the same structure of requirements (clauses 4–10). We therefore combine them into one system: a common policy, unified document control, one internal audit and one management review. The certification body can carry out a combined audit, which saves time and cost.
The legal requirements build on the same core: NIS2 measures and the CRA processes – vulnerability management, secure development, suppliers and incidents.
| Area | ISO/IEC 27001 | ISO 22301 | ISO 9001 |
|---|---|---|---|
| Common structure (clauses 4–10) | yes | yes | yes |
| Specific to the standard | information risk assessment, SoA, Annex A controls | BIA, continuity strategies and plans, exercises | processes, customer requirements, satisfaction |
| Internal audit and management review | shared by all three standards | ||
We publish client names only with their consent.
ISO/IEC 27001 implementation at a provider of cyber security solutions for global telecommunications operators.
ISO/IEC 27001 implementation at an international software company serving insurance and banking.
ISO/IEC 27001 implementation at a contact centre providing services for insurance, transport and healthcare.
Duration and price depend on the scope of the system (locations, processes, information systems), your current maturity and the availability of your people. After the initial consultation we prepare a proposal with phases, deliverables and a timeline; the cost structure is explained in our article How much does ISO 27001 cost.
No. The certificate is issued by an independent accredited certification body of your choice. We prepare you for the audit, take part in it and help with the response report.
Not automatically. An information security management system to ISO/IEC 27001 is a systematic, demonstrable basis for most risk management measures, but registration, procedures for reporting significant incidents (24 hours, 72 hours, one month), management accountability and training, and evidence for supervision must be handled separately. Detailed comparison.
For most essential and important entities by 19 December 2026. For former operators of essential services, state administration bodies and electronic communications operators the deadline was 19 June 2026, and the obligation to report significant incidents has applied since 19 June 2025 (source: URSIV, the Slovenian competent authority).
If you place hardware or software on the EU market that connects to another device or network, you are most likely in scope – as a manufacturer, importer or distributor, with the manufacturer carrying most obligations. The manufacturers' reporting obligation applies from 11 September 2026, including for products already on the market; the remaining requirements apply from 11 December 2027.
Yes. The standards share the same structure of requirements, so we build one set of documentation, one internal audit and one management review; the certification body can carry out a combined audit.
The new edition was published on 16 September 2026. Organisations certified to ISO 9001:2015 must complete the transition within the transition period – according to certification bodies, by 30 September 2029.
A vCISO is ongoing information security leadership on a subscription basis: regular reviews, registers, reporting to management and preparation for audits and supervision – without hiring a CISO. It pays off when you need continuity and demonstrable compliance all year round; formal decisions remain with your management.
As an aid for preparing drafts in our RegulusAi tool. Every piece of content is reviewed by an expert and approved by an authorised person in your organisation; the tool makes no changes to your systems.
In the EU, encrypted, with a separate environment for each client, role-based access control and an audit trail.
Tell us which area you are interested in and what prompted it. We will propose a date within one to two working days.
