For regulated companies
For us, compliance is not a project but the result of day-to-day operations. Because operations, development and security come from a single source, evidence is created continuously — and is ready when supervisory authorities or auditors ask for it.
The starting point
In finance, healthcare and energy, the requirements for IT security and evidence have been rising for years. Corporate groups face an additional difficulty: every company brings its own level of maturity.
But when evidence is scattered across systems, mailboxes and service providers, it takes weeks to demonstrate your own security in a traceable way.
Each company works with its own service providers, systems and processes. That makes it hard to manage security consistently.
Outsourced IT must be controlled too. Yet many service providers cannot adequately demonstrate their security measures.
Regulations
We translate regulatory requirements into concrete technical and organisational measures — and document them so they can be evidenced to supervisory authorities and auditors.
Digital Operational Resilience Act (EU)
Applies to: Financial entities in the EU and their ICT service providers
ICT risk management, handling and reporting of incidents, digital resilience testing and the management of ICT third-party service providers — including the contractual requirements that apply to us.
Circulars of the Swiss Financial Market Supervisory Authority
Applies to: Banks, insurers and financial institutions in Switzerland
Management of ICT and cyber risks, business continuity and the requirements for outsourcing — implemented in operations, documentation and contracts.
Directive on network and information security (EU)
Applies to: Important and essential entities, including energy and healthcare
Risk management measures, supply chain security, reporting obligations for security incidents and the accountability of management — with clear processes and evidence.
General Data Protection Regulation (EU)
Applies to: All companies that process personal data — especially sensitive in the case of health data
Privacy by design, transparent data flows, technical and organisational measures (TOMs) and support for your data protection officer.
Also on our radar
EU Data Act
Access to and sharing of data from connected products, and switching between cloud providers — we ensure portable data, open interfaces and an orderly change of provider.
EU AI Act
Anyone using AI must classify systems by risk, ensure transparency and build their employees' AI skills. We support AI projects so that these requirements are taken into account from the start.
How we work
Our goal is to deliver the IT security our clients expect. In this context, compliance means adhering to the regulations relevant to IT security and providing evidence of their implementation.
Trust is never automatic. Every access is verified and only granted when identity, device and context are right — targeted, controlled and limited to what is necessary.
Clear access rights, defined retention periods and traceable data flows form the basis for transparent data protection that integrates seamlessly into your processes.
Changes to systems, permissions and processes remain traceable. This makes it possible to identify risks early, assess their impact more accurately and implement security measures in a targeted way. Wherever possible, evidence is created directly in ongoing operations.
Shared standards give every company in the group guidance on security and documentation. New units are integrated step by step and connected to the existing interfaces.
What you get
We deliver these results on an ongoing basis — as a foundation for your management, your data protection officer and your auditors.
Regular report on security metrics, patch levels, incidents and open actions — understandable for management, too.
Regular review of who has access to what — documented and submitted for approval.
Logged tests that prove data and systems can actually be restored in an emergency.
Defined procedures, escalation paths and responsibilities for security incidents and outages.
Up-to-date description of the TOMs for your record of processing activities and your data processing agreements.
Overview of the systems, cloud services and subcontractors in use — as a basis for your outsourcing management.
Joint preparation for internal and external audits; we answer the auditors' technical questions directly.
Shared responsibility
Regulation cannot be fully outsourced — management remains accountable. That makes a clear division of responsibilities all the more important.
Getting started
We take a structured inventory of your IT systems, existing processes and security standards. In doing so, we align relevant risks, responsibilities and compliance requirements with your business objectives.
Based on this analysis, we develop tailored, prioritised recommendations for action. Clearly defined responsibilities and transparent documentation paths ensure a smooth process.
The measures are seamlessly integrated into your IT processes. Clear structures, reliable procedures and continuous updates ensure a high level of security in day-to-day operations while meeting all compliance requirements.
Regular reviews ensure that all measures are effective. Traceable evaluations and clean documentation give you a full overview at all times and demonstrate compliance with relevant standards.
What you can rely on
ISO 27001
In preparationCertification of ITADA
ISO
Certified security experts on the team
3
Focus industries: finance, healthcare, energy
„Audit evidence that used to tie up weeks is now available at the push of a button. Our auditors talk directly to ITADA — and we focus on our business.“
[Name folgt]
Compliance · Financial services provider, CH
Placeholder — testimonial to follow once approved by the client
Frequently asked questions
ISO 27001 certification is in preparation. Our processes are already aligned with the standard today, and our team includes ISO-certified security experts.
Yes. As an ICT service provider, we provide the contractual elements DORA requires — including service levels, audit and access rights, cooperation in the event of incidents and an exit strategy.
The report itself remains your responsibility. We detect and assess incidents and provide you with all the information in good time so that you can meet the regulatory deadlines.
Wherever possible, we rely on data centres in the EU or Switzerland. We document transparently which data is stored where in the system and service provider register.
No. We start with an assessment and build on what works. We implement measures step by step, prioritised by risk.
Every client has a documented exit strategy. Systems, access and documentation are handed over in an orderly manner — a requirement explicitly set out by DORA and FINMA.
In an initial call, we clarify which regulations are relevant for your group and where your IT stands today — without obligation and to the point.