GRC & compliance with defensible audit-ready evidence

Three things that most organisations run separately and should not. Governance is who decides, who is accountable and how that reaches the management body. Risk is a live register that drives decisions rather than a spreadsheet refreshed before an audit. Compliance is proving, with evidence, that the controls you claim are the controls you operate. Standards and regulations sit on top of that foundation — a certification project is a means, not the discipline itself. Where Hard2bit adds value is in building the foundation once so it serves every regime you fall under, instead of running a separate project per acronym.

Four things, and documentation is not one of them on its own. Evidence is defensible when it is generated by the process rather than written about it; when it carries a date and a named owner; when there is a review cadence that demonstrably happened; and when an auditor can walk the chain backwards from requirement to control to record without you narrating it. A policy stating that access is reviewed quarterly is a claim. The signed quarterly review with the accounts removed is evidence.

No. Neither certifies, and that misunderstanding is expensive. NIS2 and DORA are supervised: what you must produce is evidence of measures and of reporting within the deadlines. ENS does require certification at medium and high category. ISO 27001 is voluntary, but it is the proof a customer or a tender accepts fastest, and it covers a large share of what NIS2 asks for in Article 21 — which is why it is usually the most economical place to start.

NIS2 provides for up to 10 million euros or 2% of worldwide annual turnover, whichever is higher, for essential entities, and 7 million or 1.4% for important ones. The AI Act reaches 35 million or 7% for prohibited practices. It also places approval and oversight of the measures with the management body, so the exposure no longer stops at the IT department. In practice, though, the cost that shows up first is not the fine — it is the contract that does not get signed because there is nothing to show.

Not directly, and yes in practice. DORA and NIS2 require regulated entities to control their supply chain, so the obligation reaches you through the contract even though the regulation does not name you. This is the most common way organisations find themselves in scope unexpectedly: the customer is a financial entity or a public body, and suddenly controls are required that nobody had asked for. The difference between handling it and losing the account is usually having prepared before the procurement questionnaire arrives.

An early warning within 24 hours of becoming aware, a full incident notification within 72 hours, and a final report within one month. Those are not deadlines you meet by improvising on a Sunday night — they assume a classification procedure, a named responsible person and a channel already agreed with the authority. Building that before an incident is a fraction of the work of building it during one.

It can. The regulation distinguishes between those who develop an AI system and those who deploy it, and deployers carry obligations of their own, including AI literacy for the staff operating it. The first step is not legal but inventory: knowing which AI systems exist in the organisation, who uses them and for what. In many companies that list does not exist, and tools contracted by business units surface that nobody has reviewed.

It is audit-oriented: each control maps to evidence, a review cadence, a named owner and traceability from requirement to control to record. Documentation not backed by real records collapses in the first serious audit, and it protects nothing in the meantime.

We cover supply-chain impact: provider classification, SLAs and controls, evidence, reporting and contractual obligations, with particular focus on DORA and NIS2 depending on your role and customer type. If you supply a financial entity, the register of information and the exit clauses stop being paperwork and become contract conditions.

A 30 to 45 minute scoping session covering jurisdictions, critical services, third parties, key customers and existing documentation. From there Hard2bit defines quick wins and a roadmap. You do not need to arrive with anything organised — part of the value of the session is organising it.