Free gap analysis · In two weeks you have a costed roadmap Book yours →
Free analysis

ISO 27001 · ISO 42001 · NIS2 · DORA · Larissa

ISO 27001 certification and NIS2 compliance, without stopping your business.

KodeX GRC is a compliance and cybersecurity consultancy based in Larissa, Greece. We handle certification readiness for ISO/IEC 27001:2022, ISO/IEC 42001:2023, NIS2 (EU Directive 2022/2555), DORA and GDPR — from the free gap analysis (2 weeks) to sitting beside you at Stage 1 and 2 of the audit. Typical time to readiness: 4 months. Serving organisations across Greece and the EU, in Greek or English.

We design the system, build it with you, and sit beside you when the auditor arrives — with mapped controls, collected evidence, and audit trails your auditor actually accepts.

Free gap analysis See the method
ISO 27001:2022 ISO 42001 NIS2 DORA GDPR
kodex.grc — compliance scan live

Example compliance-scan output: ISO 27001 — 247 in-scope assets, 93/93 Annex A controls, 412 evidence items, 94% readiness, 12 open findings. NIS2 — 40/45 Article 21 measures, 89% readiness. ISO 42001 — 14 AI systems, 38/42 Annex A controls, 76% readiness, 8 open findings.

ISO/IEC 27001ISO/IEC 42001NIS 2DORAGDPRISO 27017 · 27018OWASP ASVSCIS BenchmarksSOC 2 readinessTISAX ISO/IEC 27001ISO/IEC 42001NIS 2DORAGDPRISO 27017 · 27018OWASP ASVSCIS BenchmarksSOC 2 readinessTISAX
01
The Trust Loop

Discover. Observe. Govern. Secure. Prove.

Five moves, one continuous loop — from knowing what you have to being able to prove it.

Trust Loop
  1. i.

    DiscoverFind everything

    You can't protect what you haven't found. We map every system, dataset, supplier and account — including the ones nobody wrote down.

    • Asset and data-flow inventory
    • Shadow IT and exposed-service discovery
    • ISO 27001 and NIS2 scope definition
    Free gap analysis
  2. ii.

    ObserveWatch continuously

    A continuous picture, not a once-a-year snapshot. We scan, correlate and rank what actually matters.

    • Continuous vulnerability scanning (CVSS · EPSS · CISA KEV)
    • Log and cloud-configuration monitoring
    • Critical findings flagged within 24 hours
    Vulnerability assessment
  3. iii.

    GovernOne system, every framework

    Policies people follow, not policies people file. One management system, mapped to every framework.

    • ISMS to ISO/IEC 27001:2022
    • NIS2, DORA, GDPR and ISO 42001 mapping
    • Board accountability under NIS2 Article 20
    ISO 27001 certification
  4. iv.

    SecureTest and harden

    We test your controls the way an attacker would — then close what we find.

    • Manual penetration testing, retest included
    • M365, AWS and Azure hardening to CIS
    • Prioritised, targeted remediation
    Penetration testing
  5. v.

    ProveEvidence on demand

    Evidence ready before the auditor, the customer or the regulator asks.

    • Audit-ready evidence pack for Stage 2
    • Board-level reporting
    • We sit beside you at the certification audit
    See a sample report
02
The method

Five phases toward a system that holds.

Every phase has a clear deliverable, a clear cost, and clear evidence it was completed.

i / v

Assessment

We see what you actually have.

Two weeks. A gap register you can hand to the board.

Duration2 wks
ii / v

Design

One system. Four frameworks.

We write the system around how you already work — not the other way round.

Duration3 wks
iii / v

Implementation

Controls that hold under real attack.

We deploy them, then try to break them.

Duration4 wks
iv / v

Certification

The auditor is not surprised.

We audit first, so theirs is procedural.

Duration3 wks
v / v

Maintenance

The certificate is the beginning.

Most systems don't fail in year one. They fail in year two.

DurationOngoing
AssessmentDesignImplementationCertificationMaintenanceOngoing AssessmentDesignImplementationCertificationMaintenanceOngoing
03
Readiness

Compliance framework status.

Every control, measure and article mapped to one source of truth. Updated continuously — not once a year.

Framework Controls covered Readiness Status
A.1 ISO 27001Information Security 100% ✓ certified
A.2 NIS2Essential Services 89% ⚠ 5 findings
A.3 DORADigital Operational 94% ✓ ready
A.4 ISO 42001AI Management 76% ⚠ in progress
A.5 GDPRData Protection 98% ✓ ready
04
Real numbers

Real numbers. Real breaches.

This isn't theoretical risk. It's the cost organisations like yours are already paying — and the clocks that start the moment an incident does.

4.88M$

Global average total cost of a data breach

IBM Cost of a Data Breach 2024
258days

Average time to identify and contain an incident

IBM · Global average
60%

Of small businesses close within 6 months after a serious cyberattack

National Cyber Security Alliance
20M€

NIS2 maximum fine — or 4% of global annual turnover

Directive (EU) 2022/2555 · Article 34
24hrs

Early-warning deadline to the competent authority after an incident

NIS2 · Article 23
74%

Of breaches involve a human element — error, fraud or misuse

Verizon DBIR

Sources: public reports 2023–2025 (IBM, Verizon, ENISA, NCSA) and EU law. Reputational impact, customer loss and operational downtime are not captured in these figures.

05
The evidence

Measurable. Clear. No surprises.

Numbers we can defend — not statistics that sound good.

2weeks for the gap analysis
5phases, each with a deliverable and a cost
4frameworks from one set of controls
4months typically to readiness
Headquarters
Larissa, Thessaly, Greece
Frameworks
ISO/IEC 27001:2022, ISO/IEC 42001:2023, NIS2 (EU 2022/2555), DORA, GDPR
Typical duration
4 months to certification readiness
Gap analysis
Free · 2 weeks · delivers a costed roadmap
Languages
English, Greek
Service area
Greece and the European Union
06
Services

Everything you need to prove you're secure.

01

ISO 27001 — certification readiness

An information security management system built for ISO/IEC 27001:2022: Statement of Applicability, risk register, policies, internal audit and management review. The standard clients ask for by name.

 02

ISO 42001 — AI governance

Responsible AI under ISO/IEC 42001:2023 layered onto your existing management system: AI system inventory, risk assessment, responsible-AI policy and mapping to the ISMS. No second, parallel project.

 03

NIS2 — Directive (EU) 2022/2555 compliance

Scoping to your entity category, Article 21 cyber-risk measures, 24-hour incident-reporting workflow and board accountability. Maximum fine: €20 million or 4% of turnover.

 04

GDPR — data protection

Record of Processing Activities (ROPA), DPIAs, processor assessments, data-subject rights workflows and breach handling. Privacy that survives a supervisory-authority audit.

 05

Penetration testing

Manual testing with defined scope and rules of engagement, CVSS scoring, a documented report and retest after remediation. A report your auditor will actually accept.

 06

Vulnerability assessment

Asset discovery and inventory, continuous scanning, prioritisation by exploitability (not CVSS score alone) and a remediation plan with owners and deadlines.

 07

Cloud security — M365, AWS, Azure

Configuration review against CIS Benchmarks, identity and privilege checks, access policies, logging, detection and hardening. Misconfiguration — not exotic exploits — loses most environments.

 08

Virtual CISO (vCISO)

Senior security leadership on demand: strategy and roadmap, quarterly board reporting, risk and vendor oversight. Only the hours you actually need.
07
Timeline

The 12-week road to certification.

Clear milestones. Clear commitment. No hidden steps.

WEEK 01–02
Scoping & discovery
Boundaries, in-scope assets, gap register delivered.
WEEK 03–05
SoA & design
Statement of Applicability, risk management plan.
WEEK 06–09
Build & implement
Controls live, evidence pipeline, owners assigned.
WEEK 10–11
Internal audit
Dry run, finding closure, corrective actions.
WEEK 12
Stage 1 & 2 audit
The auditor on site. We sit beside you.
08
Who you'll work with

One lead on every project.

The founder leads every engagement personally. There is no sales team between you.

Vasilis Stamos

ISO & NIS2 Lead Auditor

15+ years as an engineer before moving into cybersecurity and compliance. Today, focused on safeguarding the digital world, he designs and audits information security, privacy and AI management systems for organisations in Greece and across the EU.

LinkedIn profile
  • 27001ISO/IEC 27001:2022 Lead AuditorMastermind · auditing information security management systems
  • 27701ISO/IEC 27701:2025 Lead AuditorMastermind · privacy information management (GDPR)
  • 42001ISO/IEC 42001:2023 Lead AuditorMastermind · AI management systems
  • AIAI Technical PractitionerCisco · RAG and AI workflows
  • EHEthical HackerCisco · technical and penetration testing
  • B.Eng.B.Eng. Electronics, Music and Media TechnologyBachelor of Engineering
  • M.Sc.M.Sc. CybersecurityUniversity of West Attica
  • M.Sc.M.Sc. by Research, Advanced Cybersecurity Technologies & GovernanceUniversity of Piraeus · in progress

08 — Frequently asked

The questions we hear first.

How long until certification readiness?

For a mid-sized organisation, typically around four months from the gap analysis to Stage 2. The exact timeline emerges from the analysis.

Do we need a separate project for each framework?

Not from the start. We build a common core (risks, policies, incidents, continuity, audit) with a mapping table to each framework, and add only what is unique — Information Register and TLPT for DORA, deadlines and management liability for NIS2, AI impact assessment for ISO 42001. The second framework costs a fraction of the first.

Will you be present at the audit?

Yes. We sit beside you at Stage 1 and Stage 2 and answer the findings together.

What do I get from the free gap analysis?

A prioritised gap register and a costed roadmap. It's yours — you can hand it to another consultant too.

09 — Gap Analysis & Start

Ten questions that start the gap analysis.

These are the questions we ask every organisation. If you can't answer all of them with evidence, there's a gap — and we know where to start.

  1. 01What is the scope and purpose of the certification you're after?Framework
  2. 02Do you have an up-to-date inventory of information assets and data flows?Inventory
  3. 03How do you identify, assess and prioritise security risks?Risk
  4. 04Who owns each control, and how is its operation evidenced?Controls
  5. 05How quickly do you detect and respond to security incidents?Incidents
  6. 06How do you manage suppliers and third-party relationships?Suppliers
  7. 07What training does staff receive, and how is its effectiveness measured?People
  8. 08How do you ensure business continuity after a serious incident?Continuity
  9. 09What is your relationship with the certification body, and when is the next audit?Certification
  10. 10How mature is security governance at board level?Governance
Start a conversation ./ sample report
No commitment Confidential Greek or English