What we do after the audit
KleoSEC implements the technical measures an ISO 27001 or NIS2 audit prescribes and delivers the evidence that they are in place, under your name or as your partner. You lead the advisory and documentation, we do the technical implementation.
Verify, remediate, prove.
Verify
Penetration testing (external, internal, web applications), vulnerability assessment, IT/OT network architecture review.
Remediate
Hardening to CIS benchmarks, network segmentation and OT zones, MFA and privileged-account review, closing gap-analysis findings.
Prove
Retest, implementation report and deployment of tools that record the evidence for the auditor: central logging (SIEM), EDR and backup with restore test.
What the audit prescribes, what we deliver.
| Audit finding | ISO 27001:2022 Annex A | NIS2 Art. 21(2) | Our delivery | Evidence for the auditor |
|---|---|---|---|---|
| No verified vulnerabilities / no pentest | A.8.8, A.8.29 | (e), (f) | Pentest + retest after remediation | Report and retest confirmation |
| Weak access control, no MFA | A.5.15, A.5.18, A.8.2, A.8.5 | (i), (j) | MFA rollout, privileged-account review | Configuration and account list before/after |
| Flat network, OT and IT together | A.8.20–A.8.22 | (e) | Segmentation, firewall rules, OT zones per IEC 62443 | Network diagram and zone-crossing test |
| No logging or detection | A.8.15, A.8.16, A.8.7 | (b) | Central logging / SIEM, EDR on endpoints | Log-source coverage, test alert |
| Backup never restore-tested | A.8.13 | (c) | Backup setup and restore test | Restore test record |
| Non-standard configurations | A.8.9 | (e) | Hardening to CIS benchmarks | Compliance report before/after |
You choose the model for each client.
Client
NIS2 / ISO 27001 entity
You
Consultant / auditor
KleoSEC
Technical implementation
- Contract with the client
- You, we are your subcontractor
- Invoices the client
- You, with your own margin
- What you get
- Reports on your template, the client stays yours
What we do not do
ISMS documentation, policies and procedures, running the audit, SOC or on-call. No advisory to your clients - NDA and a non-solicitation clause are part of every partner agreement.
Way of working
Remote, with on-site work for OT and network tasks. A typical scope takes 5–15 working days. Plan and estimate within 48 hours of receiving the gap-analysis findings.
Who we are
Security integrator based in Croatia. OSCP+, PNPT, CNPen, eWPT, eJPT; ISA/IEC 62443 in preparation.
Documents you can forward to your clients.
What we do after the audit - service overview
Što radimo nakon audita - opis usluge
Case study: IT/OT architecture for solar power plants
Case study: IT/OT arhitektura za solarne elektrane
Sample remediation report, ISO 27001 / NIS2 audit evidence (R-2026-003-IR)
Primjer izvješća o provedbi mjera, dokaz za ISO 27001 / NIS2 audit (R-2026-003-IR)
TWO DIFFERENT REPORTS
The sample is the remediation report, not the pentest report.
The remediation report documents which measures were implemented, how, and with what evidence, mapped to ISO 27001 Annex A and NIS2 Art. 21. It is written for the auditor and your client's management, so it is deliberately short on exploit detail. The penetration test report is a separate, more detailed document: every finding with proof of concept, reproduction steps, CVSS score, affected components and remediation guidance. Available as an anonymised example on request, under NDA.
The sample remediation report is anonymised and illustrative. The structure and level of detail are what you receive.
Have a client between gap analysis and certification?
Send us the anonymised findings and we return an implementation plan with an estimate within 48 hours.