01Our expertise

Consulting & Governance: strategy and compliance

Align the information system with business strategy, master risk, and sustain compliance.

At a glance

IT masterplan
Fractional CISO
GDPR · CNDP · NIS2
EBIOS / ISO 27005

Governance rests on a set of decisions that are owned and held over time, far more than on the binder that records them. We work at board level and alongside operational teams to build a realistic IT masterplan, map actual risk exposure, and turn regulatory requirements (GDPR, Morocco's law 09-08, NIS2) into concrete, auditable controls.

Our services

What we take on

Digital transformation consulting & IS urbanisation

Clarify the target state, sequence the roadmap and select the right solutions before committing budget.

IT & business strategic alignment
Translate business objectives into measurable IS capabilities and arbitrate investment priorities.
IT masterplan (SDI) design
As-is mapping, target architecture definition and a costed multi-year roadmap.
Business-side project support (AMOA) & solution selection
Requirements specification, scoring matrix, vendor consultation and support through to the decision.

Governance, Risk & Compliance (GRC)

Establish a security function that decides, documents and reports.

Fractional CISO (vCISO)
An experienced CISO a few days a month: security roadmap steering, committees, auditor and insurer relations.
Information security policies (ISSP)
An operational document set: security policy, charters, procedures and the evidence auditors expect.
Risk management & impact analysis (EBIOS / ISO 27005)
Risk assessment workshops, credible attack scenarios and a prioritised treatment plan.

Compliance & regulatory frameworks

Move from legal obligation to a demonstrable, documented and sustained framework.

Personal data protection (GDPR, CNDP / law 09-08)
Records of processing, data protection impact assessments, privacy notices, CNDP filings and DPO support.
International regulatory compliance (NIS2 directive)
Applicability analysis, gap assessment against requirements and a remediation plan for in-scope entities.

What you get out of it

01
Documented decisions
Every architecture or investment decision rests on a written analysis that holds up in committee and in audit.
02
Risk finally quantified
Scenarios are assessed in business impact rather than abstract technical scores, so leadership can actually decide.
03
Sustainable compliance
Controls are sized for the team you actually have, so they stay alive after the engagement ends.