The path to compliance looks complicated at first sight, but Certudo significantly simplifies this journey: a process with clear stages, each with a concrete result. Here is what it all looks like, from self-assessment to audit, and how you avoid getting stuck.
1. Establishing the classification
You start from the entity classification (essential or important) and from a risk assessment, which confirms the CyFun level into which you fall (Basic, Important or Essential). It is important that the classification is established correctly: too high, and you spend needlessly; too low, and you risk not implementing required controls.
2. You carry out the maturity self-assessment
You go through the CyFun controls across the six functions and self-assess your maturity, on documentation and implementation criteria. The result is a complete picture: where you stand against the expected reference and how large the gap is. Here, most often, people overestimate themselves; a correctly carried out assessment ultimately ensures a complete implementation and an audit with favorable results.
3. You build and execute the plan
From the difference between where you stand and where you need to get to, the implementation plan results, prioritized by risk. You create the processes, implement the measures, create the documentation and registers and collect the evidence as you work, not before the audit, when everything becomes impossible.
4. You go through the internal audit
Before the official audit (DNSC-qualified), an internal audit checks whether you are truly prepared. Its purpose is not to show something perfect, but to identify the gaps while you can still remedy them. It is the best practice for avoiding a qualified external audit with an unfavorable opinion.
5. The qualified external compliance audit
The compliance audit is performed by DNSC-attested cybersecurity auditors. The auditors independently verify whether the measures exist, work and whether there is evidence to that effect. Well-done documentation, with correlated registers and up-to-date evidence, makes the difference between an audit concluded with a favorable or an unfavorable opinion.
6. You maintain compliance
Compliance does not end with a DNSC opinion or decision. It must be maintained: annual confirmations of data and system security, incident reporting, periodic review of risks, of treatment plans, of security measures and of objectives, reassessment when the risk context, the size or the activity of the organization changes. It is a continuous process, not a temporary project.
We keep everything in one place: free tools for the first steps, self-assessment and plan, consultancy when you need a specialist alongside you, and an audit through attested partner auditors. The goal is simple: to get you to the finish line, to keep you there, to ensure continuous improvement, without blockages or uncertainty.