Compliance · Cybersecurity · Infrastructure · Implementation
Practical consulting for regulatory readiness, security and resilient IT environments.
GapIT Consulting supports organizations in assessing their current state, identifying gaps, preparing actionable roadmaps and implementing measures related to NIS2, DORA, ISO/IEC 27001, ISO 22301, TISAX, cybersecurity and infrastructure projects. After the assessment, we can also support the implementation and maintenance of technology solutions.
AssessPrioritizeRoadmapImplementEvidence
About
A boutique expert consultancy with practical IT, security and compliance experience
GapIT Consulting operates at the intersection of business needs, technology solutions and regulatory requirements. We help organizations structure, secure and develop their IT, processes and management systems through a clear, practical and personal consulting approach.
Who we are
- A consulting company focused on information technology, information security, cybersecurity, business continuity, regulatory compliance and digital transformation.
- Expertise built over more than 26 years across key IT domains, including infrastructure, networks, cloud services, virtualization, DevOps, QA, business applications, data, BI, IT governance and cybersecurity.
- An approach that combines technical, consulting, commercial and management perspectives.
Value we deliver
- We translate complex IT, security and regulatory requirements into the language of business.
- We help clients achieve clarity, direction and a concrete action plan.
- We combine regulatory expertise with practical experience in real IT environments, infrastructure projects, audits, risk management and organizational resilience.
Our approach
- We understand the business problem, technology environment, processes and regulatory context before proposing a solution.
- We work with practical measures, roadmaps, responsibilities, priorities and an evidence base.
- We support clients in assessment, planning, implementation, evidence preparation and audit or regulatory readiness.
Why a boutique team
- A small, focused and highly qualified team with personal attention to each organization.
- Flexibility, context-aware work and direct communication without unnecessary complexity.
- A practical working model focused on real outcomes, not only formal documentation.
Values
- Professionalism, integrity, confidentiality and strong expert ethics.
- Practicality, transparent communication, meeting commitments and accountability for results.
- Long-term trust and partnership based on real client value.
Training
Cybersecurity, DORA, NIS2 and operational resilience training
Practical training, workshops and simulations for building cyber culture, regulatory readiness and organizational resilience. The programs are suitable for all levels of the organization — from employees and business teams to IT, Security, Risk, Compliance, Internal Audit, Legal, Procurement and senior management.
Core training areas
Cybersecurity awareness for employees
- Cybersecurity fundamentals, cyber hygiene, phishing and social engineering.
- Secure work with corporate data, remote work, mobile devices, cloud and AI tools.
- Recognizing and properly reporting cybersecurity incidents.
Management and board training
- Cybersecurity governance, DORA and NIS2 responsibilities of management bodies.
- Cybersecurity as a business risk, cyber risk dashboards and crisis decisions.
- Executive cyber crisis simulation and management review for ISO 27001, ISO 22301, DORA and NIS2.
Regulatory resilience and compliance
- DORA for financial organizations and NIS2 for regulated, manufacturing and critical organizations.
- ISO/IEC 27001, ISO 22301, incident reporting and relation to GDPR.
- Building an evidence-based compliance program and preparing for reviews.
Incident response and crisis simulations
- Incident response lifecycle, classification, escalation, roles and responsibilities.
- DORA/NIS2 incident reporting, ransomware workshops and post-incident review.
- Tabletop exercises for cyber incidents, ransomware, supplier failure and management crises.
Business continuity and cyber resilience
- Business Continuity Management fundamentals, ISO 22301 and BIA.
- RTO, RPO, MTPD/MTOA, recovery strategies and critical dependencies.
- BCP/DR exercises, crisis management tabletop and backup/restore recovery exercises.
Third-party and supply chain security
- ICT third-party risk under DORA and NIS2, supplier due diligence and security questionnaires.
- Contractual requirements, cloud, outsourcing, managed services risk and exit strategy.
- Secure remote access for suppliers and exercises for critical supplier failure.
Technical cybersecurity for IT and Security teams
- Asset management, vulnerability and patch management, secure configuration and hardening.
- IAM, MFA, least privilege, PAM, logging, monitoring and detection.
- Backup, restore, ransomware resilience, endpoint security and cloud security fundamentals.
Role-based learning paths
All employees
Cyber culture, secure behavior, phishing, data protection and incident reporting.
Board and executives
Governance, DORA/NIS2 responsibilities, cyber risk dashboards and crisis decisions.
IT and Security
Technical controls, incident response, vulnerability management, backup and monitoring.
Risk and Compliance
Control framework, evidence, audit readiness, corrective actions and risk acceptance.
Legal and suppliers
Incident reporting, contractual requirements, third-party risk, cloud and outsourcing control.
Managed service
Managed annual cybersecurity training program
We can take over the planning, delivery and reporting of an annual training program covering cybersecurity, DORA, NIS2, ISO 27001, ISO 22301, incident response and business continuity.
- Annual training plan by roles and target groups.
- Training, workshops, tests and attendance records.
- Tabletop exercises and simulations for incidents, ransomware and suppliers.
- Management reporting and evidence base.
- Annual training and awareness report with improvement plan.
Need an annual training program?
Contact us to prepare a suitable training plan based on your sector, regulatory requirements, roles and organizational maturity.
Problems we solve
From unclear requirements to a manageable action plan.
Regulatory uncertainty
Defining applicability, scope, responsibilities and evidence for NIS2, DORA and related frameworks.
Lack of priorities
Assessing gaps, risk and complexity so resources are focused on the most important measures.
IT/OT dependencies
Distinguishing corporate IT, manufacturing/OT environments, SCADA, suppliers and critical operations.
Insufficient evidence
Building policies, procedures, registers, evidence packs and management reporting.
Core consulting services
Compliance, security and organizational resilience
NIS2 / Cybersecurity Act
Applicability & scope assessment, gap assessment, roadmap, governance model, RACI, incident reporting, supply chain and evidence pack.
DORA readiness
Assessment of ICT risk management, incident reporting, resilience testing, third-party risk and management reporting.
ISO/IEC 27001 and ISMS
Gap assessment, risk assessment, control framework, policies, procedures, internal readiness and continuous improvement.
ISO 22301 / BCMS
BIA, RTO/RPO, critical processes, BCP/DRP, crisis management, testing and management review.
IT/OT and industrial cybersecurity
Assessment of segmentation, remote access, privileged access, SCADA backup/restore, monitoring and incident response.
Governance, Risk & Compliance
Methodologies, registers, control models, reporting, compliance calendar, remediation tracker and management dashboard.
Additional infrastructure services
Infrastructure expertise for real implementation of measures
A dedicated section for services related to the design, implementation, support and control of IT infrastructure.
Networks
- LAN/WLAN design, implementation, Wi‑Fi site surveys, capacity and segmentation.
- WAN, Internet, MPLS, SD‑WAN, redundancy and QoS.
- Routing/switching, VLAN, STP, LACP, ACL and IP addressing standards.
- VPN, remote access, MFA integration, DNS/DHCP/IPAM and NAC/802.1X.
- Monitoring, diagnostics, RCA, network diagrams and configuration control.
Virtualization and Cloud
- VMware, Hyper‑V and KVM design, clusters, templates and resource sizing.
- VDI architecture, pilots, optimization and profile management.
- Docker/Kubernetes platforms, observability and security.
- Public cloud landing zones, migrations, identities, networks and cost management.
- Hybrid architectures, cloud DR, backup/replication and runbooks.
Software and system administration
- Installation, configuration and support of Windows/Linux and baseline hardening.
- Patch management, application management, standardized images and versioning.
- SAM, license optimization, backup software and recovery testing.
- Databases: HA/replication, backup/restore and performance tuning.
- M365/Google Workspace, ITSM/Service Desk, automation and scripting.
Hardware and data center
- Sizing and specification of workstations, laptops, servers, storage and peripherals.
- Rack & stack, cabling, labeling, baseline configuration and commissioning.
- Warranty and post-warranty support, repair and RMA management.
- SAN/NAS configuration, expansion, optimization and migrations.
- UPS, cooling, monitoring, arrangement and server room capacity.
Development, DevOps and Secure SDLC
- Business analysis, user stories, acceptance criteria and solution architecture.
- Web/mobile applications, enterprise systems, integrations, APIs and data models.
- CI/CD pipelines, automated tests and release management.
- QA, regression, performance and automated testing.
- SAST/DAST, dependency scanning, code review and secrets management.
Sectors and NIS2 applicability
Support for all sectors covered by NIS2
We support the sectors listed in Annex I and Annex II of NIS2. The concrete applicability is confirmed based on the legal entity, size, activity, national classification and any specific designation by a competent authority.
Sectors of high criticality
We support organizations in key sectors where cybersecurity, resilience and evidence-based risk management are critical for society and the economy.
- Energy.
- Transport.
- Banking.
- Financial market infrastructures.
- Health.
- Drinking water and waste water.
- Digital infrastructure and ICT service management B2B.
- Public administration.
- Space.
Other critical sectors
We also cover sectors where NIS2 introduces requirements for important entities, suppliers and industrial value chains.
- Postal and courier services.
- Waste management.
- Manufacture, production and distribution of chemicals.
- Production, processing and distribution of food.
- Manufacturing: medical devices, electronic/optical products, electrical equipment, machinery, automotive and transport equipment.
- Digital providers: online marketplaces, search engines and social networks.
- Research organizations.
Automotive and manufacturing sector
An offering for organizations with manufacturing processes, critical business functions, suppliers, TISAX/ISO frameworks and industrial dependencies.
- NIS2 applicability and scope assessment for legal entities, locations, processes and services.
- NIS2 gap assessment across governance, risk, incidents, continuity, suppliers and technical measures.
- Assessment focused on segmentation, remote access, privileged access, backup/restore and monitoring.
- Roadmap with quick wins, critical measures, dependencies, owners and management-level summary.
- Governance/compliance support: RACI, policy framework, risk register, supplier register and evidence pack.
Energy sector, PV and industrial environments
An offering for energy companies, PV operators and environments with industrial assets, O&M providers and critical telecommunications dependencies.
- NIS2 applicability and scope assessment for plants, industrial environments, suppliers and critical services.
- NIS2 gap assessment with evaluation of technical controls and evidence readiness.
- Cybersecurity assessment: assets, segmentation, remote access, backup/restore, monitoring and dependencies.
- Incident response and NIS2 reporting playbook with scenarios for critical operational incidents.
- Implementation services: design, delivery, installation, configuration, validation and evidence pack.
Methodology
A structured process from assessment to implementation
- 01Scope
Defining applicable legal entities, services, sites, systems, suppliers and stakeholders.
- 02Review
Document review, interviews, evidence review and understanding of real processes.
- 03Assessment
Gap assessment by domains, control framework, risk, criticality and evidence readiness.
- 04Roadmap
Priorities, quick wins, dependencies, owners, indicative complexity and management summary.
- 05Implementation
Support with policies, procedures, technical measures, deployment, testing and evidence pack.
Implementation and support
After the assessment, we can implement the technology solutions
GapIT Consulting does not stop at a report and roadmap. After assessment and planning, we can support the real implementation, configuration, validation and maintenance of the technology solutions required to execute the measures.
Design and implementation
Technical design, specifications, configuration requirements, deployment planning and coordination between business, IT, security and suppliers.
Delivery and configuration
Support with selection, delivery, installation, configuration and go-live of infrastructure, security, monitoring, backup, IAM and cloud solutions.
Support and improvement
Operational support, control checks, evidence updates, periodic reviews, remediation tracking and further improvement after initial implementation.
Price estimate
Get an indicative estimate for a consulting service
Answer a few short questions. You will receive an indicative “from” price, while we receive enough context to prepare a concrete proposal after the scope is clarified.
1 Service
2 Organization
3 Scope
4 Contact
5 Estimate
Contact
Contact GapIT Consulting
Use the form for an initial inquiry. We will contact you as soon as possible.