Security Consulting
Architecture reviews, a security roadmap and hands-on technical guidance for your team.
Services
Compliance Readiness: KVKK, ISO 27001, NIS2
Laws and standards tell you what needs to be done, not how. We compare your current state with the requirements and produce an action plan you can actually implement.
In Turkey, the technical and organisational measures under KVKK, and for businesses operating in or serving customers in Germany, the GDPR (DSGVO) and NIS2 requirements have become real business concerns.
We carry out a gap analysis and rank the gaps by importance and effort. By mapping penetration test and vulnerability assessment findings to the relevant controls, we help you produce technical evidence. We do not provide legal advice; where needed, we work alongside your lawyer.
What we test
- Gap analysis against KVKK technical and organisational measures
- Readiness assessment against ISO/IEC 27001:2022 Annex A controls
- NIS2 risk management measures (Article 21) and GDPR Article 32 technical measures
- Review of asset inventory, risk assessment and policy set
- Access management, logging, backup and incident response processes
- Supplier and third-party security
How we work
Current state
We establish the baseline through interviews, document review and technical checks.
Gap analysis
For each requirement, we document the current state, the gaps and the evidence.
Action plan
We produce a prioritised roadmap with owners and dates that can be assigned.
Follow-up
We review progress at agreed intervals and run a final check before the audit.
What you receive
- Gap analysis report
- Control-by-control compliance matrix (XLSX)
- Prioritised action plan
- Mapping of test findings as technical evidence
A good fit for
- Companies preparing for ISO 27001 certification
- SMEs processing personal data
- Turkish businesses expanding into the German market
Frequently asked questions
Do you issue certifications?
No. Certification is carried out by accredited certification bodies. We help you prepare for the audit.
Does NIS2 apply to us?
NIS2 applicability depends on your sector and size, and in Germany it is determined by the national implementing legislation. We look at the question together in the initial assessment and recommend legal confirmation where needed.
Related services
Reporting: Executive Summary and Technical Report
Clear, actionable reports for two audiences at the end of every engagement.
Web Application Penetration Testing
OWASP-based, manual-first security testing for your website, online shop and customer portals.
See your weaknesses before attackers do.
Let's define the scope together. You'll receive a written proposal with the right type of test and a clear timeline.