Practical support for security, compliance and AI governance.
Choose the area that best reflects your current challenge. Our support combines security, compliance and governance where needed, without treating each requirement as a separate project.
Security and assurance for ISO/IEC 27001 and SOC 2
We help organisations build and operate security controls that protect the business, support ISO/IEC 27001 and SOC 2 readiness, and can be evidenced in independent assessment.
- ISO/IEC 27001
- ISO/IEC 27701
- SOC 2
Assessment of the current state
A clear picture of what already works and where the gaps are.
Implementation plan
A plan of activities that fits your risks, resources and business priorities.
Implementation and evidence preparation
Processes, controls and evidence that reflect the way you actually work.
Review and continual improvement
Readiness for independent assessment and a system that is maintained after the project.
Certification body or audit firm
The certification itself, or any other independent attestation, is carried out by the appropriate certification body or audit firm.
Operational cybersecurity
We help technical controls genuinely reduce risk – from vulnerability assessment to a clear plan of corrective actions.
When you want to check your real exposure
Vulnerability assessments, penetration tests and architecture reviews help establish where real technical risks lie and how effective existing measures are.
When you are developing or changing technology
We support cloud and infrastructure security, application security, SSDLC and the design of appropriate controls during the development of new products and systems.
When you already have findings, but no clear plan
We connect technical results with business risks, set priorities and help turn corrective actions into a clear and achievable plan.
We carry out specialist activities with trusted technical experts and partner companies. HEROSA defines the scope, coordinates the engagement and connects technical findings with the organisation’s wider requirements.
NIS2, DORA and regulatory compliance
We help organisations translate regulatory requirements into clear ownership, practical controls and evidence that can be maintained over time. Our work covers NIS2, DORA, GDPR, local legal requirements and related obligations that affect your business.
Our approach connects two perspectives that are often seen separately.
Legal and regulatory understanding
Together with the appropriate legal expertise and an experienced network of associates, we establish which requirements apply, how obligations should be interpreted and where legal or contractual risks lie.
The work can cover GDPR, NIS2, DORA, the EU AI Act and/or relevant national information security requirements (the Serbian Law on Personal Data Protection and Law on Information Security).
Operational implementation
We translate regulatory conclusions into responsibilities, processes, technical and organisational measures, records and a way of continuous monitoring.
This can include an assessment of the current state, mapping of obligations, privacy by design, supplier management, support for the vDPO function and connecting requirements with existing management systems.
AI governance for ISO/IEC 42001 and the EU AI Act
We help organisations introduce AI in a controlled, responsible and accountable way. Our support combines ISO/IEC 42001, EU AI Act readiness and practical governance for AI systems already in use or planned for deployment.
- ISO/IEC 42001
- EU AI Act
You know which AI systems you use and what risks they carry.
We build an overview of internal tools, products, automated decisions and solutions the organisation procures from external suppliers.
The assessment covers business, regulatory, security and ethical risks, as well as risks related to privacy and data quality.
Responsibilities and approval processes are defined.
We define ownership, roles, approval rules and how the management board, legal, technical and business teams are involved.
AI is governed throughout its lifecycle.
We put in place policies, controls, supplier oversight, change monitoring and a way of responding when the risk, the system or its purpose changes.
We bring together ISO/IEC 42001, the EU AI Act, data protection, cybersecurity and the relevant requirements of customers and markets.
Virtual leadership and governance
Security, privacy and the responsible use of artificial intelligence require clear ownership. Yet an organisation does not have to build a full in-house function straight away in order to manage these areas seriously and continuously.
Through virtual leadership roles, HEROSA provides experience and expert capacity tailored to the organisation’s real needs.
- vCISO
- The virtual Chief Information Security Officer sets priorities, connects business and technical teams, monitors risks and helps the management board make informed decisions about cybersecurity.
- vDPO
- The virtual Data Protection Officer helps the organisation establish the accountability, processes and oversight needed for sustainable management of privacy and personal data protection.
- vCAIO
- The virtual Chief AI Officer connects the business use of AI systems with risk management, regulatory requirements, privacy and cybersecurity.
Through virtual leadership roles, HEROSA provides experience and expert capacity tailored to the organisation’s real needs.
The virtual Chief Information Security Officer sets priorities, connects business and technical teams, monitors risks and helps the management board make informed decisions about cybersecurity.
The virtual Data Protection Officer helps the organisation establish the accountability, processes and oversight needed for sustainable management of privacy and personal data protection.
The virtual Chief AI Officer connects the business use of AI systems with risk management, regulatory requirements, privacy and cybersecurity.
An engagement can include a maturity assessment, strategy development, risk management, planning of initiatives and periodic reporting to the management board. The scope and pace of work are set according to the size, complexity and stage of development of the organisation. The service can take the form of a defined project or a long-term engagement with continuous work towards defined monthly goals.
Your requirements may overlap. Your approach should still be clear.
Entering a new market
You may need ISO/IEC 27001, SOC 2 and evidence that your security controls meet customer expectations.
Operating in a regulated environment
NIS2, DORA, local legal requirements and cybersecurity obligations may need to be addressed together.
Introducing AI into the business
ISO/IEC 42001, the EU AI Act, data protection and internal accountability need to work as one system.
We bring the relevant requirements together into one practical plan, without treating every framework as a separate project.
Not sure where to start?
You don’t need to know in advance the name of the service, standard or regulatory requirement you need.
Describe the business goal, change or risk you are facing. Together we will determine which areas are relevant, in what order to act and what kind of support makes the most sense for your organisation.