Technology regulation across the EU and the Gulf has moved from guidance to enforcement. Aureon helps organisations understand what applies to them, close the gaps that matter and prove compliance with evidence rather than slideware.
We advise boards, CISOs, legal and risk teams on the regulatory obligations attached to technology and data: NIS2 and DORA in the EU, the Cyber Resilience Act for products with digital elements, GDPR and the UAE Personal Data Protection Law, sector frameworks such as PCI DSS, and the UAE and GCC information assurance regimes.
Our advisers combine regulatory knowledge with operational experience from incident response and offensive security. The result is a programme that improves actual resilience, not a parallel paper exercise.
Determination of which regimes apply to your entity and products, mapping of existing controls and a prioritised remediation plan with realistic effort estimates.
Governance, risk management measures, supply-chain security, incident reporting workflows and management accountability requirements under Directive 2022/2555 and national transpositions.
ICT risk management framework, incident classification and reporting, third-party risk, digital operational resilience testing and TLPT planning under Regulation 2022/2554.
Product security requirements, vulnerability handling, SBOM practices and the reporting obligations for actively exploited vulnerabilities that apply from September 2026.
Records of processing, breach response procedures, international transfer mechanisms, DPIAs and incident notification support across EU and UAE regimes.
ISMS design, risk assessment, Statement of Applicability, internal audit and certification readiness, integrated with your existing operational controls.
UAE Information Assurance Standards, Dubai DESC ISR, Abu Dhabi ADHICS, Central Bank requirements and SAMA Cyber Security Framework alignment for regional operations.
Decision trees, templates and rehearsed workflows covering GDPR, NIS2, DORA, CRA, PDPL and sector regulators, so reporting deadlines are met with accurate information.
Fractional security leadership, board reporting, risk appetite definition and oversight of security programmes for organisations without a full-time CISO.
Executive tabletop exercises, technical simulations and business continuity reviews that test the plans regulators expect to exist.
Entities, products, data flows and jurisdictions mapped against applicable regimes.
Controls evaluated against regulatory requirements with evidence sampling, not questionnaires alone.
Prioritised plan executed with your teams, from policy to technical control to evidence capture.
Ongoing monitoring, internal audit, management reporting and readiness for supervisory review.
Clear, usable outputs for executives, technical teams, insurers and regulators.
Yes. We support responses to supervisory requests, prepare evidence and, together with counsel, help you present a credible remediation plan.
We are not a certification body. We prepare organisations for certification and audits by accredited bodies and support them through the process.
We maintain a unified control framework mapped to each regime, so a single set of controls and evidence satisfies multiple regulators without duplicate effort.
Often yes, provided governance, accountability and reporting lines are clearly defined. We design the arrangement to meet regulatory expectations on management responsibility.
An unauthenticated directory traversal in the vCenter Syslog server has moved from APT tooling to ransomware playbooks. Here is how to assure the virtualisation layer that everything else depends on.
Read article
Vulnerability and incident reporting duties for products with digital elements are live, NIS2 registration is lagging in major Member States and DORA supervision is maturing. A practical map of the obligations that now overlap.
Read article
A critical deserialisation flaw in TeamCity On-Premises let attackers into a vendor's own cloud service, where backups full of credentials were waiting. Build systems deserve the same assurance as domain controllers.
Read articleUnsure what NIS2, DORA, the CRA or the PDPL mean for your organisation? Ask our advisory team.