Capability
Compliance
Assure that things are done the proper way. We manage the frameworks and regulations that apply to you as one coherent program — so compliance is a byproduct of good security, not a separate scramble.
What this means
Compliance is the assurance that things are being done properly — against the frameworks you’ve adopted and the regulations you’re subject to. Done badly, it’s a parallel universe of audits and box-ticking. Done well, it’s simply the evidence that your security works.
We manage the full landscape — ISO 27001, NIS2, BIO2.0, the EU AI Act, DORA, and more — as one integrated program, so the controls satisfy multiple obligations at once instead of creating duplicate work.
Compliance assures that what Governance, Risk, Strategy, and Architecture have built is actually being done right — and can be shown to be.
What’s included
The work that sits within Compliance.
Under this capability
Regulations & frameworks we manage under Compliance.
The obligations and standards we manage as one coherent program.
Regulation
NIS2
The EU's updated cybersecurity directive expanded scope across 18 sectors, strict incident reporting, supply-chain security, and personal accountability for management.
Explore
⟶
Regulation
EU AI Act
The world's first comprehensive AI regulation — a risk-based framework with obligations that scale from transparency to strict conformity, for organisations that build or use AI.
Explore
⟶
Regulation
Cyber Resilience Act (CRA)
EU security requirements for products with digital elements — secure-by-design, vulnerability handling, and lifecycle obligations for anyone making or selling connected hardware and software.
Explore
⟶
Regulation
DORA
The EU's digital operational resilience regulation for the financial sector — covering ICT risk management, incident reporting, resilience testing, and third-party oversight.
Explore
⟶
Framework
ISO 27001
The international standard for information security management. We design, implement, and run the ISMS — and take you to certification and beyond.
Explore
⟶
Framework
BIO2
The information-security baseline for Dutch government — the successor to the BIO, aligned to ISO 27001/27002 and more strongly risk-based.
Explore
⟶
Framework
NEN 7510
The Dutch standard for information security in healthcare — an ISO 27001-based management system with healthcare-specific controls for protecting patient data.
Explore
⟶
How it connects
Governance sets the foundation. Risk and Strategy decide where to focus. Architecture & Transformation puts it into structure. Compliance assures it’s done right.
Compliance never works alone. It’s one of five capabilities we manage as a single, integrated function — your Managed Security & Risk Office.
Let’s make compliance a byproduct of good security.
We manage every framework and regulation that applies to you as one program — as your managed office.