Walk into your ENS audit ready — with ACCM/ENAC accompaniment

No. The official ENS audit is performed by a certification body accredited by ENAC (in many cases, ACCM). Hard2bit does everything before and alongside: pre-audit, documentation review, mock audits, gap closure plan, accompaniment during the official audit and non-conformity closure. This separation is the right one — a single provider should not be both certifier and consultant.

Pre-audit is a controlled rehearsal we run as consultants using methodology equivalent to the accredited auditor. It identifies where the official auditor would raise findings. It has no certification value — it's preparation. The official audit is performed by a body like ACCM, under ENAC accreditation, and decides whether the ENS certificate is issued.

Typically 2 to 4 months before the official audit, but it depends on programme maturity. If adequacy is solid, two months suffice for pre-audit + mock audit. With gray zones or shorter timelines, we can compress the cycle. It's also engaged for annual internal audits or 2-year certification renewals.

That's exactly what it's for. Better to find a blocking gap in pre-audit than during the official audit. We turn each finding into a concrete action with owner, date and expected evidence. If the gaps are too large for the official audit timeline, we'll advise postponing — that honesty saves a non-conformity.

Yes — on-site or remote depending on client and certification body preference. We sit alongside your owners, handle auditor requests in real time, organize evidence on demand and help contextualize technical responses. Formal interaction with the auditor is led by your organization; we provide in-room support.

A full pre-audit plus mock audit usually takes 3–5 weeks, depending on scope. Audit accompaniment runs for the duration of the official ACCM/ENAC audit (typically 2–5 days for Medium, 5–10 for High). Non-conformity closure depends on number and complexity — typically 4–12 weeks.

Irene Ocando and Thilina Manana have years of experience accompanying ENS audits and certifications under ACCM/ENAC. In addition, Hard2bit as a company passes its own ENS HIGH audit every 2 years with ACCM (certificate ENS_2.026.061). We know what the auditor asks because we ourselves answer those questions.

Yes. ENS requires periodic internal review of the system. We act as external internal auditor (not the official one — yes the internal one), produce a formal internal audit report and the associated action plan. It's one of the most-requested modes for organizations already certified that need to keep the system alive between renewals.

Yes, and it usually pays off. If your system will also be audited against ISO 27001 or NIS2, a pre-audit designed with multi-framework lens can build reusable evidence. We explain how in the ENS vs ISO 27001 vs NIS2 vs DORA comparison.

Non-conformities have a formal closure deadline agreed with the auditor. We classify them by severity, turn them into concrete actions with expected evidence, run the necessary technical or organizational changes and coordinate final verification with the auditor for formal lifting. Until then, the certificate may be issued conditionally or held in suspension.

All of it goes into pre-audit. M365, Entra ID, AWS, Azure, GCP and tech providers are typically inside ENS scope, especially for modern tech providers. Most often the auditor asks about the evidence chain that crosses cloud and third parties — and that's where improvised preparation breaks down.

It depends on system scope, target ENS category (Basic, Medium, High), timeline available before the official audit and whether you contract the full cycle (pre-audit + mock + accompaniment + closure) or modules separately. The initial diagnostic session is always the first step to scope a proposal. Request it without commitment.