Step 1 · The estate
What exists, including the forgotten.
What we do, in detail
IT consultancy, managed systems, data protection roles, and NIS2 readiness.
Program 01 · Advice, then work
IT consultancy
Most IT problems presented as technical turn out to be decisions nobody made: what the system is actually for, who owns it, what happens when it stops. We look at the estate, say what we would change and in what order, and put a cost against each. Where a decision belongs with you rather than with us, we will say so rather than quietly making it, because a supplier who decides things for a client ends up owning them in ways neither party intended.
Step 2 · The purpose
What each system is actually for.
Step 3 · The gaps
Named and ordered by risk.
Step 4 · The plan
Costed, so it can be decided.
Step 1 · The agreement
Signed before any access.
Step 2 · The handover
Credentials, inventory, owners.
Step 3 · Operations
Monitored, patched, backed up.
Step 4 · The restore
Tested, not assumed.
Program 02 · You stay controller
Managed systems
Running your systems means handling the personal data in them, so the processing agreement comes before the credentials. You remain the controller, we act as your processor, no sub-processor is engaged without your authorisation, and at the end we return or delete the data at your choice rather than ours. Backups are only real if a restore has been tested, so we test them. We make no claim that any system is secure against all attack.
Program 03 · Not a legal service
Roles and agreements
The roles follow from who decides what data is used for, not from what a contract says, and a processor that starts deciding purposes becomes a controller for that processing. So the written agreement records what is actually happening. It also sets the breach route: a controller has seventy-two hours to tell the supervisory authority, a processor must tell the controller without undue delay, so we tell you at once because your clock starts then. We are not lawyers and this is not legal advice.
Step 1 · The reality
Who actually decides what.
Step 2 · The roles
Recorded as they really are.
Step 3 · The chain
Sub-processors listed and approved.
Step 4 · The exit
Return or delete, your choice.
Step 1 · Scope
Whether and how you are covered.
Step 2 · Measures
Proportionate, and written down.
Step 3 · Rehearsal
The 24-hour report, practised.
Step 4 · The board
Approving, and recorded doing it.
Program 04 · Your board, not ours
NIS2 readiness
The Belgian rules transposing the second network and information security directive came into force in October 2024 and expressly cover providers of managed services. Reporting runs to a tight rhythm: an early warning within twenty-four hours, a notification within seventy-two, a final report within a month. The part clients miss is governance, because the management body has to approve and supervise the measures and can be liable for failing to. That accountability is your board's and cannot be outsourced to us.
Want your systems looked at properly?
A free first conversation, with no obligation.