NIS2, ISO 27001 and vCISO guides.
Practical guides to NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
NIS2 registration with the ILR: who must register, what to submit and what happens next
Entities in scope of Luxembourg's NIS2 law register themselves with the ILR through its self-registration form. The deadline was 10 July 2026. What the form asks for, how the ILR confirms your status, and what follows.
NIS2 incident notification in Luxembourg: what to report to the ILR, when, and a template
In Luxembourg, significant incidents go to the ILR through the SERIMA form: a preliminary notification within 24 hours, an incident notification within 72 hours and a final report within a month. What counts as significant, what each report contains, and a template.
ISO 27001 certification in Luxembourg: the process, accredited bodies, cost and local rules
ISO 27001 certification in Luxembourg works as it does everywhere: an ISMS, about three months of evidence and a two-stage audit by an accredited body. What is local: OLAS accreditation, the NIS2 law's reference to standards, and PSDC archiving status.
Security annex in supplier contracts: what each clause asks for, and how to answer it
A security annex turns your customer's security requirements into contract terms with a clock, an audit right and a consequence. Its core is usually the eight supplier contract points in Regulation (EU) 2024/2690. Ten clauses, what each costs, what to negotiate, and a checklist.
vCISO first 90 days: the plan for a part-time security owner
A vCISO or part-time security owner's first 90 days should produce four things you can prove, not forty policies. The six fifteen-day phases, what to refuse, and the four yes-or-no tests that tell you at day 90 whether it worked.
Ground segment security: what a satellite operator checks before giving a supplier access
Before a supplier gets into a ground segment, the operator checks who will have access, how they connect and what that access can reach. The six areas of the review, where they come from under NIS2, the EU Space Act proposal, and what to build first.
ISO 27001 surveillance audit: what happens in years two and three, how long it takes and what the auditor samples
An ISO 27001 surveillance audit happens at least once a calendar year, the first within 12 months of certification, and takes about a third of the initial audit time. What it must cover, what the auditor samples, and what happens when it goes wrong.
ISO 27001 and ISO 9001: what you can reuse, what is new, and how to run one integrated system
ISO 9001 and ISO 27001 share the Harmonized Structure, so a quality system already runs most of what ISO 27001 needs. What transfers, what is new (risk treatment, the SoA, 93 controls), how integrated audits and audit time work, and what ISO 9001:2026 changes.
ISO 27001 risk register: what it must contain, a template, and what auditors check
ISO 27001 requires every risk to have an owner, a level scored against your own criteria, a treatment, and the owner's acceptance of what remains. What the register must contain, a copyable template, and what auditors check first.