Practical guidance on ISO 27001, ENS, NIS2, DORA and SOC 2, written by the team that runs security for companies without an internal security function.
A 2026 comparison of Formalize, Copla and Qalea: what each GRC platform does well, who it is built for, and who runs the controls between audits.
How SAST, DAST, dependency scanning and code review differ, what each finds and misses, and how to combine them into testing your auditors and customers accept.
The ten cybersecurity measures NIS2 Article 21 requires, how proportionality applies, what management has to approve and the evidence a supervisor will ask to see.
What DORA requires for resilience testing, which financial entities must run threat-led penetration testing and what everyone else still has to test each year.
How a SaaS company scopes ISO 27001, which Annex A controls carry the most weight for a cloud product and what the auditor will ask to see.
When a software or SaaS company needs ENS to sell to Spain's public sector, how the category is set and what cloud delivery adds to the audit.
An ISO 27001 certificate is kept by running the ISMS every year. The records each surveillance audit samples, and how to arrive at recertification ready.
SOC 2 scope decides what the report proves. How to draw the boundary of the system and write a description that customers accept and auditors can test.
What continuous compliance monitoring checks, how control drift turns into audit findings, what the main frameworks require, and why control checks need threat monitoring alongside them.
What counts as proof of ENS compliance in a Spanish public tender, who can issue it, how scope and category are checked, and the timing rules that decide whether a bid is admitted.
EDR, XDR and MDR explained: what each one detects, what it misses, where a SIEM fits, and what ISO 27001 and the ENS expect to see from monitoring.
How NIS2 sorts companies into essential and important entities, why both share the same obligations, and how supervision, fines and registration differ between the two categories.
A guide to Annex II of the ENS: how its 73 measures are organised, how category and dimensions decide which apply, and what evidence each framework needs.
A consultant brings judgement, a platform brings continuity, and neither operates your security controls. What each delivers for ISO 27001 and what to ask before choosing.
DORA lets five types of smaller financial entity apply a simplified ICT risk framework. Who qualifies, what Article 16 still requires, and which obligations it leaves untouched.
The initial ISO 27001 audit runs in two stages. What Stage 1 reviews, what Stage 2 tests, how nonconformities are graded and who makes the certification decision.
Phishing simulations are only useful if you measure the right things. How to design realistic campaigns, which metrics matter, and how results count as ISO 27001 and ENS evidence.
Vulnerability scans and penetration tests answer different questions. What each one covers, how often to run them, and what ISO 27001 and ENS expect, using PHP2Shell as a worked example.
How to run an ISO 27001 risk assessment that auditors accept: what clauses 6.1.2, 6.1.3 and 8.2 require, how to score risks and how results feed the SoA.
SOC 2 Type I and Type II test different things. Learn what each report covers, why customers usually ask for Type II, and what has to keep running during the observation period.
ISO 27001, SOC 2 and TISAX share much of their control ground but produce a certificate, a report and a label. Where they overlap and what differs.
What DORA and NIS2 each require for supplier risk management, where ISO 27001 already covers the ground, and how to build one supplier inventory that serves both.
What an ISO 27001 Statement of Applicability must contain, how to decide which Annex A controls apply, how to justify exclusions and what auditors test in it.
What a virtual CISO is, what it handles in practice, how it differs from a full time CISO or an MSSP, and the signs a company needs one.
What ISO 42001 adds for a company that already holds ISO 27001: role classification, the AI impact assessment, data provenance, transparency and AI incidents, with an implementation order.
Which Spanish companies are in scope of NIS2, how it reaches SMEs through the supply chain, and the measures, reporting deadlines and board accountability it requires.
How a compliance platform collects evidence from your systems, maps each item to the control it supports, and keeps the audit trail that proves a control operated over time.
A 2026 comparison of Oneleet, Sprinto and Qalea: what each does well, who each is built for, and who watches the controls between audits.
What has to keep running between one ENS audit and the next: operational measures, the records an auditor will ask for, changes that bring the audit forward, and who runs it.
A 2026 comparison of GlobalSuite, Complaion and Qalea for Spain's ENS: what each does well, who each is built for and who does each stage of the scheme.
What ISO 27001 requires for security awareness: clauses 7.2 and 7.3, Annex A control 6.3, what a compliant programme contains and the evidence auditors check.
How an ENS audit works: what sets the scope and category, when accredited certification is required, and the evidence the auditor checks in each framework.
NIS2 and DORA both set staged incident reporting deadlines that start the moment you detect. Here is the 24, 72 and one-month structure, and what it takes to meet it.
The EU Cyber Resilience Act sets binding security rules for products with digital elements. What it covers, what manufacturers must do, and the deadlines that already apply.
A 2026 comparison of Vanta, Drata and Qalea: how the two compliance platforms differ, and where a Spanish company needs ENS and operated security instead.
A practical guide to choosing compliance software in Spain, built around the two questions that actually decide it: framework coverage including ENS, and whether the platform operates your security.
A compliance platform closes documentation, not security. What a licence does not do, and why the honest comparison is one licence against the full stack you would otherwise assemble.
The questions every team asks before an MDM rollout - browsing, messages, photos, location, wipe - answered honestly, and split by personal versus company-owned devices.
What you think is exposed online and what actually is rarely match. What tends to be left open, and how to prioritise it by real risk.
A consultant delivered documents, the certificate arrived, then the project stalled. How to restart ISO 27001 without starting over, with the surveillance audit close.
A Spanish public tender just demanded the ENS and you have never dealt with it. The two decisions that set cost and timeline, and what to do in a fortnight.
DORA is built on five pillars, from ICT risk management to third-party oversight. What each requires, who is in scope, and why the third-party pillar catches non-financial companies.
SOC 2 rests on five Trust Services Criteria, but only one is mandatory. What each covers, which you actually need, and how Type I differs from Type II.
Most companies that think they have an ISMS just have a folder of policies. What a management system really is, and how to tell the two apart.
Where ISO 27001 and the Esquema Nacional de Seguridad genuinely overlap, where they do not, and how to build one management system that satisfies both.
Why a control that exists on paper, a control that has been checked once, and a control that runs every day are three different things.
How the Esquema Nacional de Seguridad decides whether your systems need a self-assessed declaration or a certification audit by an accredited body.
BARCELONA — Qalea announced a US$1,000,000 funding round to accelerate product development and go-to-market execution.
Leave us your data and we will get in contact with you shortly.
