Services
Governance, risk and compliance, from assessment to operations
We support your organisation in designing, implementing, operating and auditing the technical and organisational information security measures required by the standards, regulations and laws that apply to it. We assess where you stand, define the path and operate with you the management system that sustains it, at the level of management, policies, processes and evidence.
Service areas
Everything that managing security and compliance demands
Nine areas that combine according to your need: a one-off assessment, a certification project or ongoing support. In all of them we use the Infosec Tools platform, and all of them have the technical and organisational nature described at the end of this page.
Assessment and gap analysis
Before investing, it matters to know precisely where the organisation stands. We compare your practices, documents and evidence with every requirement of the chosen framework and return a clear picture: what you already meet, what is missing, what is critical and where to start.
We run gap analyses against every framework we work with: ISO/IEC 27001, ISO 22301, ISO/IEC 27701, ISO/IEC 42001, NIS2 and the Portuguese cybersecurity legal regime, the CER Directive, the Digital Maturity Seal, DORA, PCI DSS, SWIFT CSP, SOC 2, the AI Act, the CRA, the GDPR, ANACOM Regulation 303/2019, NIST CSF or CIS Controls.
What we deliver
- Survey of the applicability criteria of each regulation and of the role the organisation may fall under (essential or important entity, critical entity, ICT service provider, manufacturer, controller or processor), for validation by your legal advisers, and of the security requirements that follow from it
- Requirement-by-requirement gap analysis, with the current state, the evidence found and the gap
- Maturity assessment of security and compliance practices
- Prioritised roadmap, with effort, dependencies and quick wins
- Readiness assessment before a certification audit or an external assessment
- Independent second opinion on programmes under way
Regulatory compliance
The number of regulations and laws with information security requirements keeps growing, and many organisations do not know for certain how to prove they comply. We build and maintain with you a compliance requirements register: every information security requirement arising from the applicable standards, regulations, legislation and contracts, identified together with your legal advisers, who is responsible for it, where it is met, what gaps it has and when it is reviewed.
We then link each requirement to the controls and the evidence, so that compliance is demonstrated rather than asserted.
Regulations and standards we work with
- NIS2 and the Portuguese Cybersecurity Legal Regime (Decree-Law 125/2025, Regulation 756/2026 and the QNRCS): framing as an essential or important entity, registration on the CNCS platform, security officer and permanent point of contact, risk matrix, minimum measures and incident notification
- Resilience of critical entities (CER Directive and Decree-Law 22/2025): entity risk assessment, resilience measures and plan, point of contact and incident notification to the authorities, aligned with the NIS2 obligations
- Digital Maturity Seal (Selo de Maturidade Digital, cybersecurity and privacy dimensions): assessment against the requirements of the target level (bronze, silver or gold), implementation and preparation for certification, awarded by an accredited certification body
- DORA: digital operational resilience of financial entities and the security and resilience requirements for their ICT service providers, including the register of information and the technical and organisational requirements to be reflected in contracts
- AI Act: inventory of AI systems, support for classification by risk tier, AI literacy, governance and transparency documentation for customers
- CRA: products with digital elements, security by design, SBOM, coordinated vulnerability disclosure, notification to ENISA and conformity assessment
- PCI DSS: scope definition, reduction of the cardholder data environment and preparation of the SAQ or the ROC
- SWIFT Customer Security Programme: assessment against the CSCF and preparation of the annual attestation
- SOC 2: scope and applicable Trust Services Criteria, control design and implementation, readiness assessment and preparation for the Type I or Type II report, issued by an independent auditor
- Security of electronic communications networks and services (Law 16/2022 and ANACOM Regulation 303/2019): security officer and permanent point of contact, classification and inventory of assets, risk analysis, exercise programme, annual security report and notification of security breaches to ANACOM
- GDPR and Law 58/2019: technical and organisational data protection measures, described under data protection
- Tracking of changes to the applicable standards and regulations and of their impact on the requirements and the measures in place
Management systems and governance
A management system is what turns a set of controls into something that lasts: with an owner, an improvement cycle and evidence. We implement management systems for information security (ISO/IEC 27001:2022), business continuity (ISO 22301) privacy (ISO/IEC 27701) and artificial intelligence (ISO/IEC 42001), standalone or integrated, prepare them for certification and support them afterwards. The certificate is issued by an accredited, independent certification body; our role is to make the organisation ready for it.
At the governance level, we define the model: roles and responsibilities, committees, security strategy and programme, policy framework and indicators for top management.
What we deliver
- Scope, context, interested parties and security policy
- Framework of policies, standards and procedures, written to be used and not just shown
- Statement of applicability and risk treatment plan
- Internal audit programme and management review
- Preparation for the certification body's audits (stage 1, stage 2 and surveillance) and support during them
- Governance model: roles, committees, strategy, security programme and budget
- Indicators and reporting to the board
- Continuous operation of the management system, supported by the Infosec Tools platform
Risk and third-party management
Risk is what decides where to invest. We define with you a methodology proportionate to the organisation, aligned with ISO/IEC 27005 and ISO 31000, and carry out the assessments the regulations require: from information security risk to third-party risk, from data protection impact assessments to the risk of AI systems.
The supply chain is today the largest source of risk and of cascading obligations. We help you know your suppliers, define the security requirements you should impose on them, and verify and prove that they are met.
What we deliver
- Risk management methodology and risk matrix, including the matrix required by the cybersecurity legal regime
- Risk assessments, treatment plans and residual risk follow-up
- Business impact analysis (BIA) and data protection impact assessments (DPIA)
- Risk assessment of AI systems
- Supplier security policy, classification and due diligence
- Technical and organisational security requirements to be included in supplier contracts (GDPR, DORA and NIS2), for integration by your legal advisers
- Register of information on contractual arrangements with ICT third parties (DORA)
- Monitoring and periodic assessment of suppliers
Data protection
We treat data protection as part of information security. We support controllers and processors in implementing and maintaining the technical and organisational measures required by the GDPR and Law 58/2019, in coordination with their legal advisers, and provide the data protection officer function when the organisation does not want or cannot have it in-house.
What we deliver
- Records of processing activities, as controller and as processor
- Data protection impact assessments
- Procedure and internal workflow for responding to data subject rights requests
- Personal data breach management procedure, including risk assessment and preparation of the notifications to the CNPD and to controllers
- Register of sub-processors and international transfers and of their security measures
- Internal data protection, retention and disposal policies, and privacy by design and by default in projects and systems
- Data protection officer as a service
Resilience, incidents and product
When something goes wrong, the difference lies in knowing beforehand who decides, who communicates and within which deadlines. We prepare the organisation to manage incidents and crises, to keep operating and to meet the notification obligations that now pile up: CNCS, CNPD, ENISA and financial-sector customers.
For those who develop software or products with digital elements, we bring security into the development lifecycle and prepare what the CRA requires.
What we deliver
- Incident management policy and procedure, with the notification workflows and the deadlines of each regime (24 hours, 72 hours, final report)
- Crisis management and tabletop exercises for top management
- Business continuity programme: strategies, plans, tests and lessons learned
- Secure development policy and security requirements across the lifecycle
- Vulnerability management and coordinated vulnerability disclosure
- Software bill of materials (SBOM) and product security incident response
- Conformity assessment and technical documentation for the CRA
- AI governance policy and transparency documentation for customers
Audit
An audit is only useful if it is independent, pragmatic and says what matters. We audit your control environment against the standard, regulation or contract at stake, identify what is critical and recommend practices that solve the problem, not just close the nonconformity.
Types of audit
- ISO/IEC 27001, ISO 22301, ISO/IEC 27701 and ISO/IEC 42001 internal audits
- Audits of compliance with regulatory and contractual security requirements
- Readiness audits before certification or external assessment
- Supplier and third-party audits
- Assessments for PCI DSS and SWIFT CSP and SOC 2 readiness assessments
- Technical support in preparing for and accompanying external audits, inspections and information requests from authorities, including the exercise of the audit rights set out in DORA
Roles as a service
Not every organisation has the size for a full-time CISO, data protection officer or security officer, but every one needs someone who answers for those roles with continuity. We take on those roles as a service, with defined hours, regular presence and accountability to management.
Roles we provide
- CISO as a service: strategy, programme, reporting to the board and liaison with customers and auditors
- Data protection officer (DPO), designated with the CNPD
- Information security officer and permanent point of contact under the cybersecurity legal regime
- Compliance officer for information security and privacy
- Support to the in-house officer: mentoring, second line and cover during absences
Training and awareness
We provide information security training and awareness programmes that address the human behaviours that improve security and reduce risk.
Regulations now require training: NIS2 obliges management bodies to be trained, the AI Act requires AI literacy from those who operate AI systems, and the GDPR and DORA require awareness programmes. We design programmes tailored to the organisation's context and maturity, for top management, for teams and for all staff.
Available programmes
- General information security and data protection awareness
- Training for management bodies required by NIS2
- AI literacy required by the AI Act
- Team training: risk management, incident management, internal audit and secure development
- Simulated phishing campaigns
- Customised e-learning and multimedia content
How we work
Infosec Tools: the platform where all of this lives
The services above do not just produce documents. The requirements register, the statement of applicability, the policies, the risks and their treatment plans, the suppliers, the incidents and their notifications, the audits and nonconformities, business continuity and training live in Infosec Tools, the SaaS platform developed by PFC Consulting, so that the management system keeps running after the project and the evidence is ready for any audit.
We use it in every implementation and operation project. The client keeps using it with us, as a service, or on their own.
Discover Infosec ToolsWhat lives on the platform
- Compliance requirements register and statement of applicability, with ISO/IEC 27001 and NIS2 side by side
- Policies and procedures with version history and reading confirmations
- Risks, opportunities, treatment plans and risk matrix
- Suppliers and third parties, with their assessment and follow-up
- Incidents, with the regulatory notification workflows (NIS2, GDPR, AI Act)
- Audit programme, nonconformities, security reviews and exceptions
- Business continuity and business impact analysis
- Assets, access, joiners and leavers, and training
- Complete audit trail and dedicated environment per customer
Frameworks
Standards, regulations and legislation we work with
Standards and frameworks
- ISO/IEC 27001Information security management systems
- ISO/IEC 27002Information security controls
- ISO/IEC 27005Information security risk management
- ISO/IEC 27701Privacy information management
- ISO/IEC 42001Artificial intelligence management systems
- ISO/IEC 27017 and 27018Controls for cloud services and protection of personal data in public clouds
- ISO 22301Business continuity management systems
- ISO 31000Risk management: principles and guidelines
- NIST CSFNIST Cybersecurity Framework
- CIS ControlsCenter for Internet Security Critical Security Controls
- PCI DSSPayment Card Industry Data Security Standard
- SWIFT CSPCustomer Security Programme and its Customer Security Controls Framework
- SOC 2Reports on controls against the Trust Services Criteria (AICPA)
European Union regulations
- GDPRRegulation (EU) 2016/679, General Data Protection Regulation
- NIS2Directive (EU) 2022/2555, security of network and information systems
- Implementing Regulation (EU) 2024/2690Technical and methodological requirements of the NIS2 measures for digital service providers
- CER DirectiveDirective (EU) 2022/2557, resilience of critical entities
- DORARegulation (EU) 2022/2554, digital operational resilience for the financial sector
- AI ActRegulation (EU) 2024/1689, harmonised rules on artificial intelligence
- CRARegulation (EU) 2024/2847, Cyber Resilience Act, cybersecurity requirements for products with digital elements
Portuguese legislation
- Decree-Law 125/2025Cybersecurity Legal Regime, transposing NIS2
- Regulation 756/2026Regulation of the Cybersecurity Legal Regime: MyCiber platform, incident notification, QNRCS, risk matrix and minimum measures
- Digital Maturity SealSelo de Maturidade Digital: certification in the cybersecurity and privacy dimensions, bronze, silver and gold levels
- Decree-Law 22/2025Resilience of critical entities, transposing the CER Directive
- Law 58/2019Implementation of the GDPR in the Portuguese legal order
- Law 16/2022Electronic Communications Law
- ANACOM Regulation 303/2019Security and integrity of electronic communications networks and services
Nature of the services
Technical and organisational support
The services provided by PFC Consulting, Lda. are technical and organisational in nature. They consist of support in the design, implementation, operation, assessment and audit of the technical and organisational measures for information security, cybersecurity, business continuity and data protection set out in the standards, regulations and legislation referred to on this page, and in performing the roles of information security officer, data protection officer and the other roles listed here, in the terms in which those standards and regulations provide for them.
PFC Consulting, Lda. is not a law firm or a firm of solicitadores, and its services do not include the practice of acts reserved to lawyers and solicitadores as defined in Portuguese Law no. 49/2004 of 24 August, namely legal advice, the drafting of contracts and the preparatory acts for the formation, amendment or termination of legal transactions, and legal representation. Determining the legal regime applicable to each organisation, interpreting the law and drafting contractual instruments are matters for the client's legal advisers, with whom PFC Consulting coordinates its work. PFC Consulting's services do not replace legal advice.
Need support with information security?
Contact us to discuss how we can help your organisation.
Get in touch