NIS2, ENS and ISO 27001 compliance
We prepare your company for NIS2, ENS or ISO/IEC 27001 and support you through the audit.
- 3 to 6 months depending on standard and size
- Fixed written quote within 48 hours of the assessment
- Remote, anywhere in Spain
- On site in the Comunidad de Madrid
NIS2, ENS and ISO 27001 compliance in Móstoles: we prepare your company to comply with NIS2, Spain's National Security Framework (ENS) or the ISO/IEC 27001 standard.
We analyse what is missing and produce the work plan, the policies and the evidence, and we support you through the audit.
We also answer the security questionnaires that clients send.
Read more Read less
Preparing and supporting you is not the same as certifying. Certification is issued by an independent certification body, not by us. Preparing for compliance takes 3 to 6 months depending on the standard and the size of the company, and we give you a fixed written quote within 48 hours of the assessment.
Request a quote
To talk about NIS2, ENS and ISO 27001 compliance, call or write to us and we'll tell you the next steps.
How we help
- A client sends you a security questionnaire.
- A client asks you for a certification to keep working with you.
- You want to bid for public contracts that require the ENS.
- You supply a company affected by NIS2 and it asks you for proof.
- You want to organise your security with a recognised framework such as ISO/IEC 27001.
What this service is
This service prepares your company to comply with one of three frameworks: NIS2, Spain's National Security Framework (ENS) or the ISO/IEC 27001 standard. They are not the same thing.
NIS2 is a European cybersecurity directive. The ENS is the security framework for the Spanish public sector, and some public contracts require it.
ISO/IEC 27001 is an international standard for organising information security.
Read more Read less
The work follows a clear order: we identify what is missing, draw up a plan, prepare the policies, gather the evidence and support you through the audit. We also answer the security questionnaires that clients send. A questionnaire of this kind usually asks how data is protected, who has access to it and what is done when an incident occurs.
Preparing and supporting you is not the same as certifying. Our role is to get the company ready to demonstrate what it does and to be at its side during the audit.
Which companies it is designed for
It is designed for companies that sell to the public sector, to large companies or to regulated sectors and are asked to demonstrate their security.
The request can arrive in several ways: a clause in a contract, the specifications of a public tender or a questionnaire from a client.
Not every company faces the same requirements. NIS2, for example, does not reach every SME in the same way: it depends on the sector and the size.
That is why it makes sense to start by clarifying what you are being asked for and who is asking.
Read more Read less
If you have the contract, the tender specifications or the questionnaire, keep it to hand when you speak to us. That document helps to see exactly what is being asked for and which standard makes sense to look at first.
Common reasons to start
These are the common reasons why a company starts this work.
In several of them, someone outside the company asks for proof, and saying that things are done properly is not enough.
- A client sends you a security questionnaire or asks for a certification to keep working with you.
- You want to bid for public contracts that require the ENS.
- You supply a company affected by NIS2 and it asks you for proof of how you protect its information.
- You want to organise your company's security with a recognised framework such as ISO/IEC 27001.
Supplying a company affected by NIS2 has a practical consequence: that client asks you for proof of how you protect its information.
You need to be able to show it with documents and records.
Read more Read less
With ISO/IEC 27001 the reason may be different. Sometimes nobody requires it yet, but the company wants to organise its security with a recognised framework instead of dealing with each issue separately.
How we work, step by step
We start with an assessment of your starting point.
Without it we do not know what you already have in place or what is missing, so a price cannot be set on a sound basis either.
After the assessment, we give you a fixed written quote within 48 hours.
Next come the gap analysis and the work plan. A gap, here, is the distance between what the standard requires and what the company does today.
Then we put controls, policies and evidence in place with your team, because it is your people who will have to apply those procedures day to day.
Read more Read less
Before the external audit we carry out an internal trial audit. It shows what is weak while there is still time to fix it. Finally, we support you during the external audit.
How we start
- Assessment of your starting point and a fixed written quote within 48 hours.
- Gap analysis and work plan.
- Putting controls, policies and evidence in place with your team.
- Internal trial audit.
- Support during the external audit.
- Assessment of your starting point.
- Fixed written quote within 48 hours of the assessment.
- Gap analysis and work plan.
- Putting controls, policies and evidence in place with your team.
- Internal trial audit.
- Support during the external audit.
What is included
The service covers the whole preparation, from the first comparison against the standard to the certification audit.
We write policies and procedures tailored to the company, not generic documents with a different name on the cover.
Evidence is the proof that what is written down is actually done: records, minutes or configurations, for example.
It is what the auditor asks for, which is why we prepare it with you before the auditor arrives.
Read more Read less
We do not promise that you will pass the audit or obtain the certificate. That decision belongs to the certification body. What depends on us is the preparation and the support.
- Gap analysis between your current situation and the chosen standard.
- Work plan with priorities, owners and dates.
- Policies and procedures tailored to the company.
- Preparation of the evidence the auditor asks for.
- Internal audit ahead of the certification audit.
- Support during the certification audit.
- Answers to security questionnaires from clients.
Price and timescale
This service is quoted after the assessment, because the price depends on the standard, the size of the company and what you already have in place.
We give you a fixed written quote within 48 hours of that assessment.
Preparing for compliance takes 3 to 6 months depending on the standard and the size of the company.
A company that already has policies and records does not start from the same place as one starting from scratch.
When comparing quotes of this kind, ask which standard they cover, whether there is an internal audit beforehand, whether support during the certification audit is included and what happens with the certification body's fees.
These are the questions that make clear what you are buying.
3 to 6 months depending on standard and size
What we do not do
- Certification, which is issued by an independent certification body.
- The certification body's fees, which are not included.
- Legal advice on whether a specific law applies to your company.
Read more Read less
We do not certify. ISO/IEC 27001 or ENS certification is issued by an independent certification body. We prepare the company and support it, and it is important that you are clear about this from the start.
Nor do we give legal advice on whether a specific law applies to your company. We can explain in general terms who each standard is aimed at, but that specific answer is a matter for your legal adviser.
Who you will deal with
Aitor heads Oteo and looks after client relationships.
You can tell him what you are being asked for, who is asking and when you need it.
You can also ask him who will handle each part of the work. With that information it is easier to agree on how to proceed.
Where we work
We work remotely anywhere in Spain and on site in the Comunidad de Madrid. Our office is in Móstoles.
If your company is in the Comunidad de Madrid, we can work at your premises when needed. If it is in another region, the work is done remotely.
Questions about NIS2, ENS and ISO 27001
In the questions on this page you will find general answers on who each standard applies to, how long it takes and how it is quoted.
They are there to guide you, not to decide whether a specific law applies to your company.
There is one dated fact worth reading carefully: as of 6 November 2026, the Spanish law transposing the NIS2 directive has not been published in the BOE, Spain's official gazette.
In the meantime, the requirement arrives mainly through contracts.
Read more Read less
With the ENS there is also a distinction to make. In the basic category, a declaration of conformity is enough; in the medium and high categories, a certification is required.
Questions about NIS2, ENS and ISO 27001 compliance
Is my company required to comply with NIS2?
It depends on the sector and the size. The NIS2 Directive applies to medium-sized and large companies in the sectors listed in its Annexes I and II, and only in some cases to small ones. Each company has to be looked at in detail, and we do that in the consultation. Legal advice on whether a specific law applies to your company is outside the scope of this service.
Is there a Spanish NIS2 law yet?
As of 6 November 2026, the Spanish law transposing the directive has not been published in the BOE, Spain's official gazette. In the meantime, the requirement arrives mainly through contracts: affected companies ask their suppliers to demonstrate their security.
What is the difference between an ENS declaration and an ENS certification?
In the basic category, a declaration of conformity is enough, and that is a self-assessment. In the medium and high categories, a certification is required, with an audit by a certification body.
Who issues the certification?
An independent certification body, for both ISO/IEC 27001 and the ENS. We do not certify: we prepare the company and support it through the audit.
How long does it take?
Between 3 and 6 months, depending on the standard, the size of the company and its starting point.
How much does it cost?
It is quoted after the assessment, because it depends on the standard, the size of the company and what you already have in place. The fixed written quote reaches you within 48 hours.
Can I use the assessment to answer a client's questionnaire?
It works as a basis: it tells you what you can state today and what is worth fixing before you answer. The complete answer to the questionnaire is part of this compliance service.
Exposure assessment
We review from the outside what an attacker can see of your company and give you a report for management and a prioritised plan.
Outsourced security lead (vCISO)
A person responsible for your company's security, without hiring them full-time.
Security awareness and phishing simulation
Practical training for your staff and simulated phishing emails, with aggregated results for management.
Penetration testing
Controlled, authorised penetration tests on your website, your applications or your infrastructure.
Tell us what you are being asked for
Call us on +34 699 240 879 or email [email protected]. Tell us which standard you are being asked for, who is asking and by when.
With that information we will explain how to proceed.
If you do not yet know which standard you should be looking at, tell us what you have received and we will go through it with you.