The baseline
A security roadmap your management decides on and can defend, built on the gap between what it expects, what is required and what your teams declare is in place.
GapsMeasured, then rated by business impact and by risk.
RoadmapDecided by management: three to five priorities, a deadline.
Behind what is declared, real control remains unknown. Management’s expectations, the applicable requirements and the security in place are described by different people, in different documents, and rarely compared.
NIS2 makes management accountable: it approves the risk-management measures and oversees their implementation (Article 20). The assessment checks, measure by measure, the gap between what Article 21 requires of you and your operational reality, and gives management a roadmap it can defend before the supervisory authority.
Everyone starts from the same picture of where you stand, from the executive committee to the auditors, and management knows what it decided and why: the target, the order of priorities, the deadline and the budget envelope as an order of magnitude.
“Set the course from reality and its gaps.”
Four steps, in this order: write down what management expects, gather the applicable requirements in a single register, establish the operational reality as declared, then measure the gaps and have the sponsor decide on them.
| Deliverable | Who it is for |
|---|---|
| Orientation report: executive summary, the priorities decided, findings and reservations, presented to the sponsor | Management, executive committee |
| Unified register of applicable requirements, one requirement per line, linked to all its frameworks | Compliance, CISO |
| Maturity score by domain and prioritised action plan | CISO, CIO |
| Detailed gap matrix, each finding marked “declared, to be proven” | Compliance, auditors |
It is not an audit: no technical verification happens at this stage. The diagnosis rests on what is declared, which is proven later on the real systems, at the Orchestrate step of the O³ method.
Engagements where this offer played a part, on its own or alongside others.
Three challenges of a public financial institution's 2024 strategic plan: Blooo brought out 40 uses of secure decentralised architectures with every business division, and ran the impact analyses on know-your-customer and authentication.
This offer’s part: The know-your-customer impact analysis, followed by a pilot put into operation.
After an audit by its supervisor and ahead of DORA: a cybersecurity training programme for more than 130 people in a public financial institution's IT department, designed, run and then handed over to the client.
This offer’s part: A training needs assessment, before the programme was designed.
40% of the three-year programme delivered in the first year
Within the architecture team of a major public transport operator, Blooo assesses, designs and maintains the security of the applications with the highest cybersecurity requirements.
This offer’s part: An assessment of the existing estate, before the security architecture of each application.
Tell us about your context: an expert will get back to you.
or write directly to trust@blooo.io
Your e-mail is sent from your own mail client: blooo.io stores nothing. We only use your details to reply to you. Privacy policy.
Living governance
Turns the diagnosis into living governance (policies, risks, indicators): compliance you can operate, not compliance on paper.