Track record
Five client cases, from single-site SMEs to multinational groups: NIS2 gap analysis, documented governance framework, integrated GRC path with TISAX and ISO 27001 certification. Cases presented in anonymised form.
Valuemate operates in Cybersecurity & Compliance through a Cybersecurity Competence Center structured across six areas, Endpoint & Infrastructure Security, Vulnerability Management, IAM/PAM, Network Security/OT, Cloud Security and Cyber Risk Management, aligned with NIS2, DORA, CRA, GDPR, the Data Act, the AI Act, TISAX and ISO 27001, as well as sector-specific standards such as BRCGS Food Safety and IFS Food.
The five cases below, referring to clients of different sizes and sectors, summarise our methodology and the results achieved in cybersecurity. They are a representative, non-exhaustive selection: our overall portfolio includes further projects not covered on this page.
Italian manufacturing company with R&D, production and commercial divisions, subject to NIS2 registration obligations.
Carry out a Gap Analysis of the current state against NIS2 requirements, supporting registration and annual update activities on the ACN Portal.
The project follows Valuemate's three-phase model for Cybersecurity & Compliance alignment: Gap Analysis (AS-IS state and approach definition), Design (organisation, policies, methodologies, processes and tools) and Implementation (operational rollout). This engagement covered Phase 1.
Gap Analysis document with reference context, AS-IS situation and minimum/optimal action plan.
5 weeks, between June and July.
Client supported in meeting the annual NIS2 update deadline, with a defined roadmap for the subsequent Design and Implementation phases.
Medium/large corporate group needing to structure a cybersecurity governance model integrated into existing service contracts.
ValuemateSecurity360, P&P (Policies & Procedures), part of the broader ValuemateSecurity360 ecosystem.
The approach was tailored to the client's organisational, technological and regulatory context, avoiding standardised or purely documentary models, with shared involvement from IT, HR, Compliance and Business.
The vCISO defined risk assessment criteria and key performance indicators, while the P&P service formalised the related operational procedures, following the sequence P&P, Operations, Governance, External Reporting, in preparation for structured engagement with ACN.
A formalised, shared and applicable security framework, supporting NIS2 compliance and future regulatory developments (e.g. CRA).
Two end-client companies operating in manufacturing (industrial machinery) and food (milling industry), served in coordination with an external IT Management partner.
Gap Analysis and set-up of compliance activities, with primary focus on NIS2 and related areas (CRA, Data Act, AI Act, GDPR, food-sector standards such as BRCGS Food Safety and IFS Food).
Both companies were addressed with the same methodological approach and timeline, tailored to their specific context, with separate paths and fees per client. The assessment covered all business areas, R&D, production, administration, customer management and sales.
Compliance context document, Gap Analysis with two compliance levels (Basic and Advanced) and priorities based on impact and opportunity, Top Management training session, work plan for the Design phase.
Activities started in spring 2026 and completed by the end of summer, in line with the NIS2 deadline of October 2026 and the first CRA deadline.
International enterprise group in the consumer sector, needing to structure a Cybersecurity & Compliance Policy and Procedure framework to support internal governance.
Gap Analysis and set-up of the P&P documentary framework, preparatory to the subsequent Design (planned for 2026) and Implementation (planned for 2027) phases.
A path structured in four sequential phases, from business and regulatory scope to the first documentary draft (details in the table below).
Mostly remote sessions, complemented by on-site workshops at key stages of set-up, management validation and first documentary draft.
A documentary framework shared and agreed with management, ready for the start of the Design phase.
Italian manufacturing company (industrial machinery), already engaged in an NIS2 Gap Analysis path (case 3), which activated a subsequent Governance, Risk & Compliance phase with Valuemate.
ValuemateSecurity360 GRC, a multi-standard compliance path structured across three sequential and integrated areas.
The service is delivered mostly remotely, with a limited number of on-site days defined after kick-off based on emerging needs. Access to the security systems under monitoring is a prerequisite, needed to gather the telemetry and information required for the Risk Assessment.
NIS2 Risk Assessment and Business Impact Analysis document, TISAX certification support path and ISO 27001 certification support path, each detailed in its specific technical annex.
A compliance path structured across multiple standards, regulatory, sector-specific and international, demonstrating Valuemate's ability to support a client from initial Gap Analysis through to multi-standard certification.
| Area | Content |
|---|---|
| Governance & Risk | Risk management methodology, NIS roles and responsibilities, internal audit and KPIs |
| Asset Management | Asset management procedure and inventory |
| Access & Identity | IAM, physical access, System Administrator management, Cybersecurity HR |
| Technical Security | Log management, secure code development, patching and vulnerabilities |
| Supply Chain | Supplier management procedure (TPRM) |
| Operational Resilience | Backup and hardening |
Indicative areas: the actual scope is defined together with the client based on their specific context.
| Phase | Content |
|---|---|
| I. Business and Regulatory Scope | Defining the scope based on the client's products, organisation, markets and operating model. Deliverable: reference context document. |
| II. Framework Set-up | Identifying stakeholders and objectives for each document. Deliverable: framework document with content per document. |
| III. Management Meeting Support | Support in preparing and, if requested, presenting the project to the client's management. |
| IV. First Documentary Draft | Drafting the documents, identifying critical points for Design and Implementation. Deliverable: agreed framework and project plan. |
Over 20 technology modules, activatable individually or in combination depending on the client's scope and maturity level.
Managed XDR, Managed Log
EDR, ITDR, Continuous Vulnerability Management, Mail Security, DNS Security
NDR, NAC, ZTNA
Continuous Threat Exposure Management (Breach Attack Simulation), Red Team, Penetration Test
Cyber Threat Intelligence, Data Security Posture Management, Data Loss Protection
Cloud Security Posture Management
Risk Evaluation, vCISO, CSIRT, 3rd Party Risk Management, ITSM, Application Portfolio Management, Policies & Procedures
5 projects delivered in phases (Gap Analysis, Design, Implementation) or as an integrated GRC path (Risk Assessment, certification).
NIS2 (incl. Risk Assessment and BIA under art. 24 of Legislative Decree 138/2024), CRA, DORA, GDPR, Data Act, AI Act, TISAX, ISO 27001, plus sector standards such as BRCGS Food Safety and IFS Food.
P&P services activated on an average scope of 13 thematic areas per client.
Over 20 modules available on ValuemateSecurity360, activatable individually or in combination.
From one-off support (fixed-fee Gap Analysis) to continuous service (24/7 SOC, vCISO, CSIRT), up to multi-standard certification support.
Proven ability to guide a client from an initial Gap Analysis to a multi-standard GRC certification path (NIS2, TISAX, ISO 27001).
Sectors served: manufacturing, food, ICT and enterprise services, up to multinational groups, with an approach replicable across other sectors subject to NIS2, CRA and DORA. Proven ability to manage multiple end clients in parallel with the same methodological framework, including in coordination with external IT Management partners.
Let's start with a gap analysis to understand where you stand against NIS2, DORA and the standards relevant to your sector.
Request an assessment →or write to info@valuemate.it
Manage consent by category. Technical cookies are always active as they are required for the site to work. The others stay off until you enable them.
Required for navigation and basic features (e.g. language and theme preference). No consent needed.
Aggregated statistics on site usage (e.g. Google Analytics) to improve content.
Profiling cookies and embedded third-party content (e.g. social, video, maps).