The security foundations auditors expect.

Many medium and large companies are, especially in manufacturing, energy, transport, digital infrastructure and services, health and food. Each EU member state applies NIS2 through its own national law, for example Sweden through the Cybersecurity Act since 15 January 2026. A Rampart Survey starts by confirming whether and how you are in scope, and which obligations apply to you.

Usually a few weeks, depending on the size of your organisation and the number of systems involved. It combines interviews with key people, a review of existing documentation and a technical look at the systems that matter most. At the end you receive a written gap report and a prioritised roadmap.

No. Documents alone do not stop incidents. Rampart Build puts technical controls in place on your systems, such as multi-factor authentication, central logging, hardened configurations and tested backups, and then documents what was done. You end up with real protection and the evidence to show it.

If you make products with digital elements, the CRA applies to you. Its reporting obligations for actively exploited vulnerabilities have applied since 11 September 2026, and the full requirements, including CE marking, apply from 11 December 2027. Rampart helps you set up the reporting routine now and plan the product requirements well ahead of the deadline.

Yes. Our controls and documentation follow the structure of ISO/IEC 27001, so the work supports a later certification if you choose to pursue one. Rampart itself does not issue certificates, and we can work alongside your certification body.

Usually one person from management, who owns the risk, and one from IT or operations, who knows the systems. We keep the time needed from your team low and adjust the pace to how your organisation works.