Executive summary
The Organisation operates a mature technology environment — active EDR, centralised identity management, documented backups. The security management system, however, remains fragmented into informal practices: things done correctly, without documentation that holds up under audit.
The analysis identified 47 findings. Three are critical, nine high, eighteen medium, seventeen low. None of the critical findings relates to technology — all three concern incomplete documentation, governance and accountability. That's good news: they close in weeks, not months, and don't require new tooling investments.
The largest compliance risk is not ISO 27001 — it's NIS2. As an essential entity, the Organisation is exposed to fines of up to €10m or 2% of global annual turnover, and to personal liability of the management body (Article 20). Today there's no documented 24-hour / 72-hour reporting procedure, and no recorded responsibility at board level.
On completing the 12-week roadmap, our assessment is that the Organisation reaches Stage 2 readiness for ISO 27001 with 94% control coverage, and 89% on the NIS2 Article 21 measures.
Scope & methodology
What was reviewed, how, and what's not covered by this analysis.
The analysis covered the entire production footprint and core services. 14 interviews were conducted with process owners, and 3 technical verifications in a test environment.
The method followed the logic requirement → control → evidence → owner. Every finding is documented with at least one specific element — a missing policy, an incomplete record, a measurable response gap.
Out of scope: physical security of warehouses outside Larissa, non-EU subsidiaries, and systems under decommissioning. These weren't scored and don't count toward the coverage percentages.
Findings overview
47 findings, categorised by severity and framework.
The three critical findings concern supply chain management, the incident reporting process and the absence of board-level accountability. All three close with procedural changes, not purchases.
Detailed findings
Four representative findings — as they appear in the full report.
Of the 31 critical suppliers processing or with access to the Organisation's data, 7 have no documented security assessment. There's no supplier register with criticality classification, and no standard security clauses in contracts.
This breaches A.5.19–A.5.22 of ISO 27001:2022 and Article 21.2.d of NIS2, which explicitly requires security measures in the supply chain.
The average response time for security incidents is 41 hours from detection to escalation. There's no documented escalation flow, and no designated person responsible for reporting to the competent authority.
NIS2 requires early warning within 24 hours and a detailed report within 72 hours. Today the Organisation cannot demonstrate that it meets these deadlines.
The Organisation grants access in a controlled way, but hasn't carried out a periodic review in the last 14 months. The last review was ad-hoc, without documentation.
This breaches A.5.18 and A.8.2, and creates immediate audit risk — the auditor will ask for evidence of a review and won't find it.
A recovery test was carried out in November 2024, but there's no documentation — no minutes, no RTO/RPO measurements, no corrective actions. The business continuity plan hasn't been approved by management since 2023.
Risk register excerpt
Sorted by residual risk. Excerpt — the full register contains 47 rows.
| ID | Risk | Likelihood | Impact | Rating | Owner | Status |
|---|---|---|---|---|---|---|
| R-003 | Data breach through unassessed supplier | High | High | Critical | CISO | Open |
| R-007 | Failure to meet NIS2 24h/72h deadlines | High | Medium | Critical | SOC Lead | In progress |
| R-014 | Unauthorised access via stale entitlements | Medium | High | High | IT Ops | Open |
| R-019 | Service outage without documented recovery plan | Medium | High | High | IT Director | Open |
| R-022 | Software development documentation non-compliance | Medium | Medium | Medium | Eng Lead | Scheduled |
| R-031 | Loss of documentation on staff turnover | Medium | Low | Medium | HR / CISO | Scheduled |
| R-038 | Incomplete phishing training for new joiners | Low | Medium | Low | HR | In progress |
Control coverage
Coverage by category of Annex A of ISO/IEC 27001:2022 — 93 controls in total.
The weakness is in A.8 — specifically in secure software development (A.8.25–A.8.28) and technical vulnerability management (A.8.8). Both are covered with procedural changes.
12-week roadmap
Every action has an owner, a deliverable and a completion week. Updated weekly.
The roadmap is interdependent: the implementation stage doesn't start until the risk plan is approved by management, and the internal audit doesn't start until the critical findings are closed. This prevents the common pattern of "skipping steps" that leads to failure at Stage 2.
Evidence checklist
The artefacts the auditor asks for — with their current status.
Next steps
What happens after this report is delivered.
The first step is approval of the risk plan by the board. It isn't a formality — it's the foundation on which the entire ISMS stands, and the first thing the auditor asks for.
The second is starting the implementation stage, with priority on the three critical findings. These close with procedural changes, not technology, and can be completed within the first five weeks.
Want an analysis like this for your organisation?
Two weeks. A prioritised gap register, a costed 12-week roadmap, and an executive summary for the board. No commitment, no charge.