Concrete engagements with clear deliverables
Every offer describes who it suits, what is included, how the work is done and what you get. All of them are gathered here by service area. If you would rather start from your industry, that section is at the bottom.
Information security and governance
About the service area →Regulatory scope assessment
A documented assessment of which regulations are relevant to your organisation, in what role and what should be done first.
Read more → AnalysisGap analysis and current-state analysis
Your current state against ISO 27001, the Swedish Cybersecurity Act (NIS2) or DORA. A decision basis with identified gaps, prioritised risks and a concrete action plan.
Read more → Ongoing supportSenior GRC advisory
A coherent structure for governance, risk management and compliance. Clear responsibilities, working processes, relevant controls and regular follow-up.
Read more → ImplementationISO 27001 from gap analysis to certification
A management system that works in practice. Risk work, governing documents, Statement of Applicability, internal audit and preparation for certification.
Read more → Swedish Cybersecurity ActManagement cybersecurity training
The Swedish Cybersecurity Act makes security a management responsibility, and from 1 October 2026 regulations on security measures and management training apply.
Scope: Defined engagement, half a day plus preparationRead more → Business continuityBusiness continuity management and exercise
What happens if a critical service is down for three days?
Scope: A few days to a week depending on scopeRead more → Classification modelInformation classification
Security work that does not know which information matters ends up either too expensive or too thin.
Scope: A few days to a week depending on scopeRead more → Current stateAI inventory and AI Act readiness
Which AI are you actually using, for what, and with which information? An AI register, a role and requirement assessment, and a prioritised action plan.
Scope: defined engagement, set by the number of use casesRead more → DORAAnnual DORA review and maintenance
DORA does not get finished. The recurring review of the ICT risk management framework, brought together as one usable piece of maintenance work.
Scope: defined engagement per period, recurringRead more →Data protection and privacy
About the service area →GDPR current-state and gap analysis
Where do you stand against the GDPR today? A documented current state, identified gaps and a prioritised action plan that management can decide on.
Read more → ImplementationGDPR Start
We start with a current state analysis and then take you to a working baseline: records, privacy information, procedures and responsibilities you can maintain.
Read more → Ongoing supportOngoing GDPR support
Operational support for records, agreements, questions, breaches and new systems, from a few hours a quarter to every week.
Read more → Data protection officerExternal data protection officer (DPO)
We act as, or support, your data protection officer: day-to-day questions, follow-up, data subjects’ rights and reporting to management.
Read more → Projects and systemsData protection impact assessments (DPIA)
DPIAs for high-risk processing, and privacy built into projects, systems and procurement from the start.
Read more → WebsiteWebsite review: cookies and public privacy notice
Cookies and the consent banner, the public privacy notice, forms and third-party services, with a prioritised list of fixes.
Read more →Management as a service
About Manager as a Service →Interim CISO and CISO support
Senior security expertise, clear governance and practical progress, adapted to your organisation’s risks, regulatory requirements and existing organisation.
Read more → Interim or ongoingIT manager as a service
Responsibility for IT operations and IT strategy, integrated into your organisation. Steady leadership in everyday work and in the projects that move the business forward.
Read more →IT services and advisory
About the service area →Microsoft 365 Health Check
Security review and hardening of your Microsoft 365 environment: Entra ID, Conditional Access, Intune, Defender, Purview and Secure Score.
Read more → Ongoing operationsIT operations as a service
Network, backup, monitoring and support with clear responsibility. Proactive management and reactive support as a long-term service commitment.
Read more → As part of the engagementHardware, software and licences
We select, procure, implement and manage equipment, software and licences as part of our engagements. The right requirement first, then the right product. Not a shop.
Read more → MigrationMicrosoft 365 migration and secure setup
Move to Microsoft 365 without treating migration, identity, security and user experience as four separate projects.
Scope: project, scope as per the proposalRead more → ReviewBackup and recovery verification
You know the backup job is green. But do you know the business can actually be recovered?
Scope: defined engagement, with restore testsRead more → ReviewNetwork and segmentation review
How the network is actually built — and whether a fault or an intrusion can spread further than it should.
Scope: defined engagement, set by the size of the environmentRead more →Cybersecurity and technical security
About the service area →Vulnerability assessment and penetration testing
Find the weaknesses before someone else does.
Scope: Defined engagement, about a weekRead more → Incident planIncident preparedness and tabletop exercise
An incident plan that works when it matters, and an exercise that shows it does.
Scope: Defined engagement, a few daysRead more → Cyber Resilience ActCRA readiness for product companies
If you sell products with digital elements on the EU market, the Cyber Resilience Act applies to you.
Scope: A few days to a week depending on the portfolioRead more →Assurance and internal audit
About the service area →ISO 27001 internal audit or NIST CSF assessment
An independent internal audit of your management system and controls against ISO 27001 or NIST CSF.
Scope: Defined engagement, one to two weeksRead more → Supply chainSupplier and third-party review
Your suppliers handle your systems and your information, but your requirements only count if someone follows them up.
Scope: Defined engagement, usually about a weekRead more → Current stateSecurity maturity assessment
An assessment of people, processes, governance and technology against established maturity models, with a level per area.
Scope: Defined engagement, a few weeksRead more → VerificationControl testing
Testing of technical and process controls, with objective evidence of which ones actually work.
Scope: Defined engagement, or recurringRead more → ReadinessPre-audit before certification
A mock audit against the standard, run the way an external auditor works, so the nonconformities are found in advance.
Scope: Defined engagement before the auditRead more →Project management
About the service area →By industry
The same expertise, different regulations and priorities. This is what engagements usually look like in the industries we work with most.
Finance and insurance
DORA: gap analysis, register of information and third-party risk. Financial regulations, ISO 27001 and an external data protection officer.
DORA · Gap analysis · DPO
Municipalities and the public sector
Information classification, NIS2 and the Swedish Cybersecurity Act, data protection and independent review of outsourced IT.
Industry and chemicals
Gap analysis and action plan against NIS2 and ISO 27001, risk-based prioritisation and ongoing support with the measures.
Medtech and healthcare
Data protection programmes and DPIAs, ISO 27001 and a long-term IT partner for operations and strategy.
Software and SaaS
A management system to ISO 27001 that meets customer and regulatory requirements, the GDPR and secure Microsoft 365.
Critical infrastructure
NIS2 and the CER Directive, operation and monitoring of critical infrastructure, continuity and supplier governance.
NIS2 · CER · IT operations
How we price
We deliver in three forms, and where an engagement lands in our hourly range depends on the service, its scope and the consultant’s role and experience. Our standard hourly rate is between SEK 800 and 1,600 excluding VAT.
Consulting Hours. Expertise when and where it is needed: interim CISO, external data protection officer, data protection coordinator, GRC support and other specialist support. Priced per hour, day or month for the agreed time.
Packaged Services. Predefined solutions and managed service packages: IT support and service desk, monitoring, backup, Microsoft 365 management and the annual DORA review. Fixed monthly or annual fee with agreed content and response times.
Project-Based Delivery. End-to-end commitments with a defined goal: gap analyses, reviews, exercises and implementation projects. Usually quoted at a fixed price or as an estimated number of hours. The price is set by the scope: the number of requirements or systems to review, the size of the organisation and how much is already documented. Each offer page states the typical scope.
You always receive a cost proposal before we start, normally within a few working days of a first meeting, and we begin no work beyond it until it has been approved.
Frequently asked questions
What does it cost?
Our standard hourly rate is SEK 800 to 1,600 excluding VAT, depending on service, scope and the consultant’s role and experience. Consulting hours are priced per hour, day or month, packaged services as a fixed fee, and projects usually at a fixed price. You receive a cost proposal before we start.
Cannot find what you are looking for? Tell us what you need and we will suggest an approach.
Contact us