CYBERSECURITY
Cybersecurity and compliance
ISO 27001, ENS, gap analysis, vulnerability assessment and pentesting: defined scope, priorities and reviewable deliverables.
See cybersecurity →CYBERSECURITY CONSULTING
Cybersecurity within your reach:
From assessment to certification
Cybersecurity consulting specialised in ISO 27001 and ENS. We carry out gap analysis and pentesting to identify vulnerabilities and support you throughout the implementation of your certification.
01 — WHAT WE DO
Start by understanding and reducing risk.
Consulting and technical validation to prepare security controls, evidence and decisions.
02 — SCOPE AND DELIVERABLES
Define the work before starting.
We agree objectives, limits and deliverables. Consulting prepares controls and evidence for an independent assessment; certification and its outcome depend on the evaluating body.
GAP
ISMS and gap analysis
Scope, risks, gaps and evidence to prepare for independent assessment.
Meet the team →TEST
Authorised pentesting
Authorised tests with agreed limits and a prioritised findings report.
See pentesting →ENS
ENS implementation
Control review, implementation plan and supporting documentation.
See ENS adaptation →What we do
Cybersecurity: assessment, controls and validation.
Start with the requirement or risk: ISO 27001 preparation, ENS implementation, control gaps or technical exposure.
ISO 27001 preparation and ISMS
Scope, risks, SoA, controls, evidence and audit preparation.
See ISO 27001 service →Adaptation to the ENS
Adaptation plan for Public Administration suppliers and regulated systems.
See ENS service →Pentesting
Web, APIs, network and infrastructure testing with technical and executive report.
See pentesting →Gap analysis
Comparison of controls and evidence against agreed requirements, with gaps and priorities.
Explore gap analysis →Vulnerability assessment
Identification and prioritisation of technical weaknesses. Unlike pentesting, it does not itself validate exploitation paths.
Consult my case →Supporting framework: NIS2
Applicability depends on context. See the dedicated page for supporting information.
See NIS2 service →Why Blue Moon
We translate security requirements into decisions, controls and evidence that the team can maintain.
- Realistic roadmap before generating documentation.
- Combined ISO 27001, ENS, NIS2 and GDPR approach to avoid duplication.
- Technical ability to validate with pentesting, AppSec and secure development.
An initial conversation to understand scope and priorities.
Policies, records and evidence to support daily operations, reviews and audit preparation.
We validate controls with testing, review and practical criteria.
Implementation, audit, maintenance and continuous improvement.
Blue Moon Method
From initial doubt to an auditable route.
A short process to understand: diagnosis, risks, controls, validation and improvement.
Diagnosis
What applies, what is missing and what to prioritize.
Initial reportRisks
Assets, threats, impact and treatment.
RoadmapControls
Measures, those responsible, policies and evidence.
ISMS/planValidation
Internal audit, technical review or pentest.
EvidenceImprovement
Monitoring, training and incidents.
Annual planREQUIREMENTS AND APPLICABILITY
What rule affects you and how to avoid duplicate work.
ISO 27001 provides international recognition; ENS is key for the Spanish public sector; NIS2 raises European standards for governance, continuity, incidents and supply chain. If they are designed together, they share controls and evidence.
| Criterion | ISO 27001 | ENS | NIS2 |
|---|---|---|---|
| What is | International standard for information security and ISMS. | Mandatory Spanish framework for the public sector and its ICT suppliers. | European directive to strengthen cybersecurity of critical sectors and supply chains. |
| Who applies | Any company that wants to protect information, sell more trust or access demanding customers. | Public Administrations and private companies that provide services to the AAPP. | Essential or important entities and suppliers that may be affected by contractual requirements. |
| Mandatory | It is not always mandatory, but more and more clients require it as a requirement. | Yes when applied by RD 311/2022 or by public specifications and contracts. | It depends on sector, size, activity and national transposition; It is advisable to analyze applicability as soon as possible. |
| Indicative deadline | The schedule is agreed after assessment and depends on scope, maturity, internal availability and third parties. | The schedule is agreed after assessment and depends on scope, maturity, internal availability and third parties. | The schedule is agreed after assessment and depends on scope, maturity, internal availability and third parties. |
| Combination | It is advisable to address them in the same roadmap: inventory, risks, controls, evidence, incidents and suppliers can be reused. | ||
Quick doubts
Short answers before diagnosis.
We clarify scope before preparing a proposal.
Can ISO 27001, ENS and NIS2 work together?
Yes. They share inventory, risk analysis, controls, evidence, incidents, continuity and suppliers.
How do I know what I really need?
With an initial diagnosis: we review the sector, clients, tenders, obligations and current maturity.
Does the first contact have a cost?
The first 30-minute review helps us understand your context and identify a suitable next step.
ADDITIONAL CAPABILITY
We also develop websites, CRM and Odoo.
Available as standalone services, without a cybersecurity engagement.
DIGITAL DEVELOPMENT
Web development, CRM and Odoo
An additional capability available separately: websites, custom CRM, Odoo modules and corrective or evolutionary Odoo maintenance within an agreed scope.
See web development and Odoo →ODOO
Odoo development and maintenance
Modules, customisation and maintenance with terms agreed for each project.
See CRM →Web development
Web development, custom CRM and Odoo modules and maintenance, available as separate engagements.
See web development →