IV Practice
Cybersecurity
Know where you are exposed, what it would cost, and in what order to fix it. Then fix it with you: identities, certificates, applications, infrastructure.
- Starting point
- Audit and gap analysis
- Hands-on
- Pentesting · PKI · IAM · backups
- Frameworks
- ISO 27001 · NIS 2 · GDPR · DORA
The question is no longer “if” but “what it will cost you”.
Regulation has changed in nature. NIS 2 extends the perimeter to thousands of organisations that did not consider themselves concerned, and puts directors personally on the hook. DORA does the same in finance.
Our job is not to sell you fear or licences. It is to measure your real exposure, translate it into euros and days of downtime, then define the correction sequence that removes the most risk for the least cost.
We do not stop at the report. The firm runs web penetration tests itself, designs and operates certificate (PKI) and identity (IAM) infrastructures, secures the applications it builds and hardens the servers it hosts.
This is for you if
- You fall within NIS 2 scope and do not know where to start.
- A client or insurer is asking for ISO 27001 certification.
- An Internet-facing application has never been tested.
- Your certificates expire without warning; your PKI is not industrialised.
- Your suppliers access your systems with no formal framework.
- An incident happened and you want to avoid the next one.
From assessment to control
-
01
Security audit
Technical and organisational assessment: architecture, identity, endpoints, cloud, backups, supply chain and what teams actually do day to day.
- Architecture and segmentation review
- Identity and privileged access management
- Backup restoration testing
- External exposure and attack surface
-
02
Penetration testing & application security
Penetration tests of web applications and APIs, run in-house on a written, authorised scope with GHOST, the audit platform built by the firm (ghost.yhconsulting.fr). Every finding is reproducible, scored and paired with its fix.
- Web and API penetration testing, OWASP methodology
- CVSS-scored, CWE-classified findings with reproducible evidence
- Code review and dependency audit of applications
- Re-test after remediation
-
03
PKI, identity & infrastructure engineering
Design, operation and automation of the security building blocks we know from the inside: certificate infrastructures, identity and access management, server hardening.
- PKI architecture and operations, certificate lifecycle
- Renewal automation and expiry monitoring
- IAM: identity governance, privileged access, strong authentication
- Linux hardening: key-only SSH, firewall, logging, tested backups
-
04
Backup & restoration
A backup is only worth the restoration you have actually performed. We design the set-up, automate it, take it off site, then really restore it on a blank environment before calling it reliable.
- 3-2-1 strategy: local, off-site and offline copies
- Encrypted backups of databases, files and configurations, rotation and retention
- Scheduled, timed and documented restoration tests
- Measured RPO / RTO, monitoring and failure alerts
-
05
Compliance & certification
Gap analysis then support through to the certification audit. We build an ISMS people can use, not a binder written for the auditor.
- ISO 27001 / NIS 2 / DORA gap analysis
- Policies, procedures and processing records
- Risk analysis and statement of applicability
- Audit preparation and support
-
06
Remediation plan
A roadmap ordered by risk reduction per euro invested. Every action has an owner, a deadline and a closing criterion.
- Risk / cost / time prioritisation
- Costing and workload planning
- Remediation programme management
- Quarterly risk level review
-
07
Resilience & crisis
Continuity planning, incident response procedures, crisis exercises with the executive committee and employee awareness.
- BCP / DRP with RTO / RPO objectives
- Incident response procedures
- Live crisis exercise
- Awareness and phishing campaigns
The frameworks we work against
- ISO/IEC 27001
- NIS 2
- RGPD / GDPR
- DORA
- ANSSI
- NIST CSF 2.0
- ITIL 4
- CIS Controls v8
- PCI DSS
- Loi 09-08
What you get
- Technical and organisational audit report
- Penetration test report: CVSS-scored findings, evidence and fixes
- Backup plan and restoration test records
- Risk analysis valued in business impact
- Gap analysis against the target framework
- Prioritised, costed and dated remediation plan
- ISMS documentation set
- Executive committee debrief pack
Frequently asked questions
Are we in scope for NIS 2?
The directive covers eighteen sectors and applies based on size and activity, including indirectly through the supply chain. We qualify your situation in a few days, before any commitment.
Do you run penetration tests?
Yes, in-house, on web applications and APIs. The scope is written and authorised before any test; testing follows the OWASP methodology and relies on GHOST, the firm's audit platform. You receive a report with CVSS scoring, reproducible evidence and fixes, then a re-test. Findings feed the remediation plan.
Do you work on PKI and identity management?
Yes: PKI architecture, operations and automation, certificate lifecycle, identity governance and privileged access. These are subjects the firm practises on long engagements with large organisations, not only in audits.
Can you take over our existing backups?
Yes. We start by restoring what you already have, on a separate environment, to learn what is really recoverable and how long it takes. Only then do we fix the set-up: automation, encryption, off-site copy, recurring restoration tests.
How long does ISO 27001 certification take?
It depends entirely on your starting maturity and the scope retained — we will not quote a timeline before measuring them. The initial gap analysis gives you that visibility, and it comes first.
Do you help during a live incident?
We support crisis coordination, communication and rebuild. For forensic investigation itself, we bring in recognised specialists.
Next step
Knowing where you stand takes three weeks, not six months.
We qualify your NIS 2 applicability and exposure level at no cost, before any commitment.
Or email us contact@yhconsulting.fr