Why us
The software shows where something is missing. But the gap does not close by itself. That is why the work does not stop at the assessment and the GAP analysis - we go all the way to implementation, technical and documented.
An organisation may have a good firewall and no documentation at all. Or the opposite: excellent policies that no one applies. The requirement is met only when both sides match and can be proven.
The table shows how the platform and the team's technical work complement each other. The same requirement gets both a trace and a real measure.
| Requirement | The platform | Technical implementation |
|---|---|---|
| Risk management and policies | Assessment of the status against the requirements, linked evidence and recorded decisions. | Audit and risk assessment, an optimisation and migration plan, implementation and documentation. |
| Access control and multi-factor protection | Roles, permissions and traceability of who changed what and when. | Identity management, multi-factor authentication, access segmentation and 802.1X for wireless networks. |
| Network and perimeter security | Asset register and the measures linked to it. | Firewalls and traffic filtering, secure remote access and VPN, building network infrastructure. |
| Continuity and recovery | Tasks with an owner and a deadline, test protocols as evidence. | Backups and a recovery plan, recovery testing and documenting the result. |
| Monitoring and incident response | Status of the open work and a history of actions. | Proactive monitoring, a centralised event log and response within agreed deadlines. |
| Servers, virtualisation and cloud | The context of the requirement and the evidence attached to it. | Virtualisation and server solutions, private cloud, data centre colocation and hosting services. |
The expertise
The technical part is carried out by the team of BGO Cloud, an IT company from Sofia that manages and maintains the infrastructure of organisations across the country. The team maintains ongoing technical qualification in the technologies it works with daily.
This means that when the assessment shows a gap in access, backups or monitoring, there is someone to fix it - not just describe it.
Certified technologies and partnerships
The certificates belong to the technology vendors and attest to qualification in the respective products and platforms. They are not a certificate of NIS2 compliance.
Five steps that lead from the first conversation to a working process - not to a report that stays in a folder.
Which activities and services fall within scope and what that means for the organisation.
A minimum against the requirements, a maximum against the real environment - documentation, access, network, backups.
Policies, procedures and responsibilities on one side, technical measures on the other.
Every requirement gets evidence, an owner and a deadline in the platform.
Monitoring, maintenance and periodic review, so the status does not go stale.
When it makes sense
Next step
We will review the scope, show what the evidence looks like at review time and discuss what is needed technically.