What we cover
Requirements generally come from two sources: legislation that applies based on where you operate or what sector you’re in, and industry standards you choose to adopt — often to satisfy customer expectations or demonstrate maturity to the market. The underlying work is similar: understand the requirements, assess your gaps, implement controls, and maintain evidence.
Legislation
In Europe, legislative requirements are often driven by the EU, with EEA and candidate countries usually adopting compatible laws. Within the EU there are several types of legislation, of which regulations and directives are most relevant. Non-compliance typically carries penalties, and in some cases personal accountability.
GDPR
The General Data Protection Regulation (GDPR) is a comprehensive privacy law that regulates how organisations process and protect personal information of individuals in the EU. It applies to any organisation, regardless of where it’s based, that offers goods or services to, or monitors the behaviour of, individuals within the Union.
The regulation is built around several core principles:
- Transparency and fairness — Be clear and open about why data is collected and how it will be used.
- Purpose and minimisation — Collect data only for a specific, stated purpose, and retain it only as long as needed.
- Accuracy — Ensure the data you hold is correct and kept up to date.
- Security — Implement strong measures to protect data against loss, destruction, or unauthorised access.
It also grants individuals specific rights, including: access to their data, correction, deletion, and the ability to withdraw consent at any time.
From an operational standpoint, organisations must establish a legal basis for processing data, report qualifying breaches to the relevant authority within 72 hours, and embed data protection into the design of new systems and processes rather than treating it as an afterthought.
Non-compliance can result in fines of up to €20 million or 4% of global annual turnover, whichever is higher.
Where do we fit
We can help with security-related requirements covered in Article 32 (security of processing). This includes implementing technical and organisational measures, building secure processes that respect data minimisation and retention principles, and ensuring your ISMS addresses data protection risks. We can also support breach response procedures and gap assessments where security and privacy requirements overlap.
We don’t offer DPO services, data subject rights processes, data protection impact assessments, legal interpretation of processing lawfulness, or representation with supervisory authorities. These require privacy expertise positioned as an independent function.
DORA
The Digital Operational Resilience Act (DORA) is an EU regulation that ensures financial entities can withstand, respond to, and recover from information and communication technology (ICT) disruptions and threats. It applies to almost all financial institutions operating within the EU, such as banks, insurers, investment firms, and payment providers, as well as their third-party technology providers, such as cloud platforms and software vendors.
The regulation is built around several core pillars:
- ICT risk management — Establish a comprehensive governance framework to identify, protect against, and recover from IT risks.
- Incident reporting — Classify and report major technology-related incidents to relevant authorities within strict time frames.
- Resilience testing — Regularly test IT systems for weaknesses, ranging from basic assessments to advanced penetration testing.
- Third-party risk management — Actively monitor and control the risks introduced by external IT suppliers and the wider supply chain.
Firms must map their critical IT assets, enforce strict security requirements with service providers, and prove they can maintain critical business functions during a severe cyberattack or ICT disruption.
Non-compliance can result in severe regulatory sanctions, personal liability for management, and for critical third-party providers, daily penalty payments of up to 1% of their global average daily turnover.
Where do we fit
We can help with ICT risk management framework development, gap assessments against DORA requirements, policy development, and third-party risk processes. If you already have ISO/IEC 27001, we can help map your existing controls to DORA requirements and close gaps.
Threat-led penetration testing (TLPT), audits, and ongoing legal consulting or regulatory filings are outside our scope. Independent verification should be sourced separately from implementation support.
NIS2 Directive
The Network and Information Security Directive 2 (NIS2) is the second iteration of the EU’s directive aimed at establishing a high common baseline of cybersecurity across all member states. It significantly expands the scope of cybersecurity requirements compared to the original NIS Directive, applying to both medium and large organisations across 18 sectors including energy, transport, health, digital infrastructure, and ICT service providers.
The directive is built around several core pillars:
- Risk management measures — Implement technical, operational, and organisational measures to manage cyber risks.
- Incident reporting — Follow strict, phased reporting requirements for significant incidents.
- Supply chain security — Assess and manage the cybersecurity risks within your broader supply chain and supplier relationships.
- Management accountability — Senior management must actively approve, oversee, and be trained on cybersecurity measures.
Operationally, organisations must establish security policies, maintain business continuity and crisis management plans, and secure network and information systems throughout their lifecycle.
Non-compliance can result in fines of up to €10 million or 2% of global annual turnover, as well as personal liability and temporary bans for senior management.
Where do we fit
We can help with scoping and applicability assessment, gap analysis against requirements, risk management framework implementation, policy development, supply chain security processes, and management briefings on accountability obligations. ISO/IEC 27001 provides a strong foundation — we can help you build on it.
We don’t provide formal legal opinions, entity classification determinations, or legal representation with regulatory authorities.
CRA
The Cyber Resilience Act (CRA) is an EU regulation that sets cybersecurity requirements for products with digital elements placed on the EU market. This includes software applications, connected devices, and their remote data processing components. It applies to manufacturers, importers, and distributors, covering the entire product lifecycle from design through to end-of-support.
The regulation is built around several core pillars:
- Secure by design — Products must be designed and developed with appropriate levels of cybersecurity from the outset, based on risk assessment.
- Vulnerability handling — Manufacturers must identify and remediate vulnerabilities, provide security updates, and maintain a coordinated disclosure process.
- Incident reporting — Actively exploited vulnerabilities and severe incidents must be reported within 24 hours.
- Transparency — Provide clear security information to users, including support duration, update processes, and a software bill of materials.
Products must carry CE marking to demonstrate conformity. Most obligations apply from December 2027, with vulnerability reporting requirements taking effect from September 2026.
Non-compliance can result in fines of up to €15 million or 2.5% of global annual turnover, whichever is higher.
Where do we fit
If you develop software for the EU market, we can help you assess development practices against CRA requirements and build compliant processes: secure SDLC implementation, vulnerability management workflows, incident reporting procedures, and documentation practices. Our background in software development and security engineering makes this a natural fit.
We don’t handle CE marking, conformity assessments for critical products, or act as your authorised representative.
Standards
Standards provide structured approaches to security tested across industries. Some are certifiable by accredited bodies; others serve as control catalogues for benchmarking or mapping. Adopting a recognised standard often satisfies multiple compliance needs at once.
ISO/IEC 27001
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It provides a structured, risk-based approach to managing the confidentiality, integrity, and availability of information. Certification is awarded by accredited bodies and is widely recognised across industries and jurisdictions — often required by enterprise customers, investors, and regulators alike.
The standard is built around several core principles:
- Risk-based approach — Identify and analyse information security risks, then select controls proportionate to the findings.
- Management commitment — Leadership must actively support, resource, and oversee the management system.
- Continual improvement — Regularly review and refine your security practices through internal audits, management reviews, and corrective actions.
- Documented controls — Maintain policies, procedures, and evidence that demonstrate how security is managed.
An ISMS does not need to be complex. The standard is designed to scale — a 70-person company and a 700-person company can both certify, with controls and documentation proportionate to their context. Certification involves a two-stage audit by an accredited certification body, followed by annual surveillance audits to confirm ongoing conformity.
Where do we fit
From initial gap analysis through certification readiness — we offer complete implementation. This includes organisational context analysis, scoping, gap analysis, security governance structure design, risk assessment support, risk treatment planning, statement of applicability (SOA), policy development, control design, control implementation support, stakeholder training, as well as management reporting, support in documentation and evidence management, and audit support.
PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) applies to any organisation that stores, processes, or transmits payment card data. It is maintained by the PCI Security Standards Council and typically enforced through card brand programmes and acquiring banks.
The standard is built around several core objectives:
- Maintain a security policy — Establish and enforce an information security policy across the organisation.
- Build and maintain a secure network — Protect systems with firewalls, secure configurations, and controlled access.
- Protect cardholder data — Encrypt stored and transmitted card data and limit retention to what is strictly necessary.
- Maintain a vulnerability management programme — Keep systems patched, deploy anti-malware, and use secure applications.
- Implement strong access control — Restrict access to card data on a need-to-know basis, authenticate users, and control physical access.
- Monitor and test — Log and monitor access to network resources and card data, and regularly test security systems.
Validation requirements depend on your transaction volume and role in the payment chain. Smaller merchants may self-assess using a questionnaire (SAQ), while larger merchants and service providers require a formal assessment by a Qualified Security Assessor (QSA).
The PCI Council also maintains related standards, including PCI 3-D Secure (3DS) for authentication components and the Software Security Framework (SSF) for payment software development. Where relevant, we can advise on these alongside your DSS engagement.
Where do we fit
We offer implementation support for PCI DSS — from scoping and gap analysis through to assessment readiness. Our hands-on experience with the standard helps you scope correctly, avoid common pitfalls, and address requirements efficiently.
PCI Secure SLC
The PCI Secure Software Lifecycle Standard is part of the PCI Software Security Framework, maintained by the PCI Security Standards Council. It establishes requirements for how software is developed and maintained, covering governance, threat modelling, secure coding practices, change management, and vulnerability handling.
The standard applies to software vendors developing products commonly deployed in payment environments. The Secure SLC qualification validates that an organisation’s development lifecycle processes meet PCI security requirements — it applies to the development organisation, not individual products.
The standard is complemented by the Secure Software Standard , which addresses the security of the software product itself. Where both standards are relevant, our software engineering background allows us to support across the framework.
Where do we fit
We can help you compare your development practices against SLC requirements, implement secure lifecycle processes, and prepare for qualification.
... and more
Many security and risk frameworks share common ground. While we are most comfortable with the standards listed above, we can help with other frameworks as well including SOC 2, CSA STAR, CIS Controls, etc.
Whatever is on your mind, don’t hesitate to reach out .
How we support compliance
In our view being compliant is not a final destination, but rather a natural outcome of what happens when security and risk are addressed appropriately. But everyone needs to start from somewhere, and targeting compliance with a specific framework is a valid and common starting point. Whether you need someone to own a domain and keep you compliant over time, implement a project that gets you to the starting line, or support you on-demand, our focus is always on developing your capability to ensure things can be managed appropriately in the long run.
Leadership retainers
As part of our leadership retainers, we own domain-specific compliance on your behalf.
PricingImplementation projects
Our projects start from where you currently are and deliver management systems that ensure sustainable compliance.
PricingReview & Advice
A light advisory project, a fixed-price deliverable, or on-demand consultancy. Support is available as needed.
PricingAbout us and our take on compliance
NoFuss Consulting is an independent consultancy specialising in risk and security governance. We help organisations build and operate management systems that enable due diligence through transparency and clarity.
While achieving compliance with a framework is a valid starting point, we don’t consider compliance an independent service category. Being compliant is an outcome — what happens when security and risk are addressed appropriately — not a destination in itself.
Standards and legislation play a valuable role. They set baselines, create accountability, and often provide the external pressure that drives action when governance is lacking. But the true goal is understanding what’s worth protecting, what could go wrong, and what’s proportionate. That’s why our compliance work is rooted in establishing appropriate capabilities and not in producing empty artefacts.