Living governance at a glance

RoadmapThe priorities and gaps from the diagnosis.
RisksAssessed and treated: EBIOS RM, ISO 27005.
RequirementsThe register of applicable requirements.

Living governanceRoles, policies, indicators and training, put in place and steered.

Proven complianceEvery requirement moves from declared to proven.Proven

The problem

Governance exists on paper but does not work: policies, risks and indicators do not describe what actually happens.

For organisations subject to NIS2

NIS2 requires security governance owned by management, risk management, and training for executives and staff alike: Trusted Organisation puts them in place and keeps them running, with evidence.

The objective

Governance that works and compliance you can operate, not compliance on paper: policies that are applied, risks that are treated and followed up, indicators that show what actually happens.

How it is measured

Requirements: a register of proven requirements, where every requirement moves from “declared” to “proven”.
Risks: risk maps before and after treatment, and residual risks accepted by management.
Steering: an indicator framework with one source of evidence per indicator, measurement reports and a first management review.
Closing: a final proof review, which can reopen a gap.

Upgrade measures are run by Blooo; for run measures, Blooo leads the first cycle, then hands over to the client or a third party.

What we do: Organise, then Orchestrate

“Turn the diagnosis into living governance and a target architecture.” Then “Drive compliance and implementation through to proof.”

Blooo designs, the client validates. The offer is sold by module:

Risks: risk assessment and treatment (EBIOS RM, ISO 27005, FAIR as a complement to quantify risk in euros), then planning and budget.
Governance: target security organisation (roles, RACI, committees), policies and procedures.
Compliance and accreditation: compliance programmes (ISO 27001, NIS2, DORA, CRA) and preparation of the security accreditation.
Measurement and training: indicators, measurement and steering, awareness and training.
Crisis (optional): cyber crisis governance, exercises and training.

Key deliverables

Deliverable	Who it is for
Risk treatment plan, with the risk maps before and after treatment and the residual risks	Management, CISO
Target governance model, information security policy, policies and procedures	Management, CISO
Register of proven requirements and accreditation file	Compliance, accreditation authority
Indicator framework and first management review	Management, CISO

What Trusted Organisation does not do

Blooo does not stand in for management: management decides, accepts the residual risks and grants the security accreditation.

The O³ method and the proof loop in detail

Proof from the field

Engagements where this offer played a part, on its own or alongside others.

SOC 2 Type II audit readiness in six months
For a 15‑person financial intermediary selling SaaS to US clients: compliance tool selection, a single repository of controls and evidence, and a SOC 2 Type II audit file ready in six months.
6 months to prepare the SOC 2 Type II audit file
An HDS-compliant software factory for a health research organisation
End-to-end compliance with French health data hosting rules (HDS) and the GDPR, and a DevSecOps platform secure by design, to build and deploy applications that handle health data.
3 separated environments: development, test and production

See all 5 case studies →

Talk to us about Trusted Organisation

Tell us about your context: an expert will get back to you.

or write directly to trust@blooo.io

Reply within 24 hours
Non-disclosure agreement on request, before any exchange
First call of 30 minutes

Your e-mail is sent from your own mail client: blooo.io stores nothing. We only use your details to reply to you. Privacy policy.

What comes next

Trusted Architecture
The design
Builds security into the design (Zero Trust, IAM/PAM, PKI), starting from the risks and the target governance.

See all our offers