5 min read
Compliance as code: keeping ISO 27001 cheap after the certificate
Certification is a project with an end date. Maintaining it is not. The difference between a cheap certificate and an expensive one is whether the evidence collects itself.
Sectius — The right measure
Security and compliance, in the right measure.
From sectio aurea, the golden section: one cut, and everything in proportion. We define the perimeter, separate what is critical, and build one programme where every control serves the whole.
One senior partner. A fixed price. Deliverables agreed before we start.
Our services
Seven practices, one team
The right measure: not the over-engineered security that paralyses a mid-size company, not the under-investment that exposes it; not cosmetic compliance, not bureaucracy. AI and the security operations lead. Cloud carries them. Governance proves them — once, for all seven practices.
AI & Cybersecurity
Deploy AI you can defend, and defend with AI.
- Strategy and governance
- AI solutions implementation
- AI security and threat defense
- Trustworthy and secure AI
- AI for cybersecurity operations
- AI training and awareness
A hundred and forty-four services, thirteen fixed-price packs
Every service has a defined scope, a duration and, for most, a price band. Browse the full catalogue or start from a pack.
Articles
Notes from the work
What NIS2 actually requires, the mistakes we see in DORA registers, a thirty-day AI Act plan, keeping ISO 27001 cheap after certification. Written from engagements, not press releases.
5 min read
The AI Act for deployers: a 30-day plan
Most companies are deployers, not providers, and the obligations are far lighter than they fear. Here is the month of work that settles the question.
5 min read
DORA register of information: the 10 mistakes we see
The register is the first thing supervisors ask for and the easiest thing to get wrong. Ten failures we keep finding, and what each one costs to fix.
Who we are
A senior specialist, and a network behind them
You work directly with a senior specialist in cybersecurity, AI and compliance, with experience across data security, software platforms and cloud. Not a sales lead who hands you to a junior after signature.
Where a mission needs a qualification we do not hold, or a jurisdiction we do not practise in, we bring in a vetted partner and stay accountable for the result.
- 144
- services in the catalogue
- 13
- fixed-price packs
- 8
- sectors served
- 17
- countries, directly or through partners
Sectors of activity
The same frameworks. Very different conversations.
Select a sector to see what is driving it and where we usually start.
Something happening now?
An incident, an audit letter, a deadline this month
Write to us and say so in the subject line. We answer the same working day, and we will tell you what to do first even if it is not us.
Client logos
Client logos
We publish a client logo only with written permission. This strip will fill as those permissions arrive.
Where we operate
Directly from France, and through partners who practise locally
- Europe
- France, Belgium, Luxembourg, Switzerland, Spain, Germany, Portugal, Italy
- French-speaking Africa
- Tunisia, Morocco, Senegal, Ivory Coast, Cameroon
- South America
- Brazil, Argentina, Colombia, Chile
Fixed price
Start with a pack
Eighty per cent of our catalogue is sold at a fixed price with deliverables defined upfront. You know the scope, the timeline and the cost before you commit.
Cyber 360 Flash
Three weeks to a clear picture: maturity, exposure and the ten things to fix first.
- Duration
- 3 weeks
- Price
- €6,000 to €9,000
- excl. VAT, indicative
NIS2 Ready
From applicability to a defensible compliance position, with the governance duties covered.
- Duration
- 8–12 weeks
- Price
- €18,000 to €35,000
- excl. VAT, indicative
AI Act Check
Every AI system inventoried, classified and dated, with the obligations that follow.
- Duration
- 3–4 weeks
- Price
- €6,000 to €12,000
- excl. VAT, indicative
How we work
Six steps, no surprises
From first call to signed proposal in five working days, and from kick-off to board readout without a single unplanned invoice.
- Step 1 of 6
Qualification call
45 minutes, freeA senior consultant, not a salesperson. We ask what is driving the deadline, what exists already, how many entities and systems are in scope, and who will have to approve the result. You get an honest read on feasibility and a range before we hang up — including, when it applies, the fact that you do not need us for this.
- Step 2 of 6
Proposal
Within 5 working daysA written proposal with the scope, the deliverables listed item by item, the schedule with dates, the people involved, and a fixed price. No day-rate estimates with a range attached, and no discovery phase billed before the scope is known.
- Step 3 of 6
Kick-off
Week 1Framework contract and mutual non-disclosure agreement signed, insurance certificates provided, access requested and granted, stakeholders identified, and the reporting rhythm agreed. We confirm the schedule against your constraints — audits, releases, holidays — before anything starts.
- Step 4 of 6
Delivery
Per the scheduleThe work runs with a thirty-minute checkpoint every week: what was done, what was found, what is next, and anything that threatens the date. Significant findings are raised when we find them, not saved for the report. Work is done in your tools and your repository wherever possible.
- Step 5 of 6
Readout and handover
Final weekA presentation to the people who have to act on it — usually the executive committee or the board — with the executive summary, the findings, and the costed action plan. Then a working handover with your team: the detail, the evidence, the configuration, and how to maintain it.
- Step 6 of 6
Follow-on proposal
Within 15 daysA written proposal for what comes next, if anything does: targeted missions from the action plan, a recurring service to hold the ongoing work, or nothing at all. Sent within fifteen days of the readout so the decision is made while the findings are fresh, with no obligation attached.
Next step
Let's take the measure of your organisation — a 45-minute call, free.
Tell us what is coming — an audit, a deadline, a customer questionnaire, an AI project nobody has reviewed. We will tell you what we would do, in what order, and what it would cost. If we are not the right firm for it, we will say so.