Skip to content
NEXTBIT

Axis 01 · Advisory & strategy

Governance, risk and compliance (GRC)

Risk analysis (ISO 27005, EBIOS RM), information security policy, ISO 27001 readiness, compliance with Law 18-07.

The challenge

Digital risks are poorly understood, security rules remain unwritten and compliance with Law 18-07 cannot be demonstrated.

This service gives your organization a written framework to know its risks, treat them and prove its compliance. NEXTBIT carries out a risk analysis based on ISO 27005 or EBIOS RM, drafts with you an information security policy that can actually be applied, and checks that your processing of personal data complies with Law 18-07. If you are aiming for ISO 27001, we prepare the management system and the expected documentation. Everything is designed so your teams can keep it up to date.

What we do

  • Risk analysis based on ISO 27005 or EBIOS RM, focused on your essential activities
  • Drafting of the information security policy and the procedures that implement it
  • Register of personal data processing and Law 18-07 compliance review
  • ISO 27001 readiness: scope, statement of applicability, indicators and management review
  • Prioritized risk treatment plan, with concrete measures and their owners

Our approach

  1. 01

    Assessment

    Interviews, document review and analysis of the existing set-up to establish current security and compliance practices.

  2. 02

    Risk analysis

    Identification of risk scenarios, then evaluation of their severity and likelihood with business owners.

  3. 03

    Framework and plan

    Security policy, procedures and risk treatment plan, approved by management.

  4. 04

    Implementation and handover

    Support for the first measures, training of internal focal points and tools to keep the framework up to date.

What you gain

  • A risk map that management can understand
  • Security rules that are written, known and applicable
  • Law 18-07 compliance that is documented and demonstrable
  • Structured preparation if you are aiming for ISO 27001

Frequently asked questions

Does this service lead to ISO 27001 certification?

Certification is granted by an independent certification body that you choose freely. NEXTBIT prepares you for it: defining the scope, risk analysis, documentation, indicators and organizing the management review. This separation between preparation and certification guarantees the independence of the final assessment.

How is this different from a technical vulnerability analysis?

GRC deals with the organization: risks, rules, responsibilities and evidence of compliance. A technical analysis examines the systems themselves, such as configurations or network exposure. The two complement each other: the findings of a technical review feed the risk analysis, and the treatment plan sets the order of fixes.

What does Law 18-07 require in practice?

Law 18-07 governs the processing of personal data: a defined purpose, consent or a legal basis, data security, the rights of the people concerned and prior formalities. We list your processing activities, measure the gaps and propose the measures, clauses and documents needed to bring you into compliance.

Related offers

Advisory & strategy