Data protection
Responsibilities, records of processing, legal bases, minimisation, rights, processors, security and breach management.
Goal: governed processing and well-managed processors.
Audit & compliance
Qualify the obligations. Measure the gaps. Organise the evidence.
The IKNSA Audit & compliance practice covers GDPR, NIS2, HDS, the AI Act, DORA, the CRA and related frameworks. It establishes the scope, assesses the situation, builds the trajectory and prepares the demonstrable elements.
Operational compliance
Cross-cutting and sector frameworks, connected to how things actually run.
The assessment determines the applicable scope, the priority gaps and the evidence already available. Common requirements are pooled without creating artificial equivalence between the texts.
Cyber resilience
Risk governance, security measures, continuity, supply chain, incident management and notification.
Goal: prepare the scope and the evidence expected in France.
Health data
Qualification of the need, sharing of responsibilities, target architecture and migration to HDS-certified hosting services.
Goal: use a certified scope with no ambiguity of roles.
Artificial intelligence systems
Inventory, legal role, classification, transparency, supplier control, human oversight and monitoring.
Financial sector resilience
ICT risk framework, incidents, testing, register of critical third parties, concentration and exit strategies.
Cybersecurity of digital products
Product risk, security by design, components, support, vulnerabilities and the conformity file.
HDS scope
Hosting or managed-services activities within the HDS scope are delivered on a certified perimeter. IKNSA designs and supports these architectures with clearly defined responsibilities for every party.
Our approach
From scope to evidence, without a programme running parallel to the information system.
Compliance becomes durable when it joins investment decisions, changes, operations and vendor contracts.
Qualify
Entities, activities, data, critical services, applicable texts and stakeholders.
Assess
Risks, existing controls, gaps, dependencies and available evidence.
Transform
Roadmap, technical measures, processes, contracts and support.
Demonstrate
Evidence files, exercises, management reviews and audit preparation.
Demonstrability
A policy is not proof of effectiveness.
Controls must produce dated, attributable, reviewable elements: decisions, test results, incidents, exceptions, reviews and action plans. We build this chain of evidence with the teams who actually operate the information system.
| Control | Examples of evidence |
|---|---|
| Risk management | Mapping, owners, decisions, treatment plans |
| Identities & access | Reviews, entitlement records, privileged accounts, leavers |
| Vulnerabilities | Inventory, scans, remediation times, exceptions and acceptances |
| Continuity | Plans, restore tests, exercises, observed RPO and RTO |
| Suppliers | Evaluation, clauses, subcontractors, service levels, exit |
Who does what
Supporting is not certifying. Preparing is not self-auditing.
We define the roles before the engagement to avoid any ambiguous promise or conflict of interest. The Audit & compliance practice is distinct from the Cybersecurity practice: they can contribute to the same programme, but their mandates, people and deliverables remain identified.
Certification bodies, regulated auditors, DPOs and technical providers keep their own responsibilities. Where formal independence is required, implementation and evaluation are not entrusted to the same actor.
- 1
Your organisation decides and owns the risk
Management approves the scope, the priorities and the residual risks.
- 2
The Audit & compliance practice structures
Qualification, assessment, roadmap, coordination and evidence preparation under the mandate.
- 3
The accredited third party evaluates where required
A certification body, qualified auditor or independent adviser acts within its own framework.
- 4
The measures live in the information system
The Cyber practice and the operations teams implement, test and improve the controls that fall under their mandate.
Frequently asked questions
Framing a compliance initiative.
Can you certify our GDPR or NIS2 compliance?
We can carry out an assessment, support the remediation and prepare the evidence. We do not present this support as an official certification. Where a qualified audit or a certification is needed, the competent third party is appointed separately.
How do we know whether our company falls within the scope of NIS2?
The analysis looks at the legal entity, its size, its sector, the nature of the services and the special cases provided for by the texts. In France, the transposition framework and ANSSI publications must be followed; we always date our analysis and document the assumptions.
Can GDPR, NIS2 and ISO 27001 be handled in a single trajectory?
Yes, by pooling risk governance, asset management, suppliers, incidents, continuity and evidence. The requirements specific to each framework remain identified to avoid artificial equivalence.
Engagement scenario
Qualify the obligations of a digital health service
A software provider handles health data through several hosts and subcontractors, without a shared view of GDPR roles, HDS scope and applicable cyber requirements.
First decisions to produce
- 01
Follow the data and hosting activities end to end.
- 02
Connect each entity, provider and contract to its actual role.
- 03
Separate common controls from requirements specific to each framework.
Expected output
An activities–actors–obligations matrix, assumptions to confirm and an assigned action plan rather than a generic conformity conclusion.
Related expertise
Continue with a concrete scope.
Explore the missions and sector approaches connected to this practice.
360° IS audit
Strategy, estate, operations and risks
View the scopeCybersecurity audit
Posture, attack scenarios and remediation
View the scopeCloud & FinOps audit
Architecture, cost, security and dependency
View the scopeApplication portfolio audit
Value, criticality, debt and trajectory
View the scopeVendor risk audit
Criticality, contracts, concentration and exit
View the scopeISO/IEC 27001 readiness
Scope, risks, controls and internal audit
View the scopeRGAA accessibility audit
Sample, manual testing and remediation plan
View the scopePCI DSS readiness
Card-data scope, segmentation and validation
View the scopeFirst conversation
Let’s discuss the next point of control for your information system.
A project to frame, operations to take over, compliance to demonstrate? Describe the context. You will get a first considered reading — not a generic brochure.