ISO 27001
The information security management system: policies, statement of applicability, controls, indicators and continual improvement, from the rule to the evidence.
See it in the cockpit →Frameworks · organisations
Frameworks supported in Galyct Pro
ISO 27001, NIS 2, DORA, the GDPR and its 72-hour notification, EBIOS RM, BIA / BCP / DRP: covered, explained and, above all, linked to a decision. Because a cyber decision must be explainable after the fact, to a customer, an insurer, an authority or your own committee.
Understand the risk. Take back control. Stay the course.
Hosted in France by Scaleway · Mistral AI (EU) · to prepare for and document GDPR, NIS 2 and DORA.
01 · THE FRAMEWORKS
Six foundations, one requirement: decide, prove, hold steady
We do not cover them to tick boxes. We translate them into responsibilities, evidence and trade-offs, the only form of compliance that stands up to an audit, an incident or a question from the regulator.
NIS 2
The European directive that greatly extends the scope: essential or important entities, hygiene obligations and stronger accountability for management.
Who is affected →DORA
Digital operational resilience for the financial sector: five pillars, ICT risk management and control of providers, applicable since 17 January 2025.
The five pillars →GDPR · 72-hour CNIL notification
Record of processing activities, impact assessments, breach notification within 72 hours: personal data handled as evidence, without cosmetic compliance.
The 72-hour obligation →EBIOS Risk Manager
ANSSI’s risk analysis method, in five workshops: from the security baseline to the scenarios, through to treatment and the residual risk decided on by management.
The 5 workshops →BIA · BCP · DRP
Business continuity: a clear distinction between impact analysis, keeping running in degraded mode and technical recovery, RTO and RPO included.
The timeline →
02 · DOCTRINE
Compliance is not about piling up documents. It is about making decisions that are proportionate, documented and defensible.
A framework is only worth something once it has been translated into responsibilities, evidence and trade-offs that are actually followed up. Galyct Pro links each requirement (ISO, NIS 2, DORA, GDPR) to a traceable decision, not to a reassuring binder. Documentation reflects real practices; never the other way round.
03 · EBIOS RISK MANAGER
ANSSI’s method in 5 workshops, all the way to the decision
A serious risk analysis does not produce an abstract matrix. It links credible scenarios to business impacts, existing measures and management’s trade-offs: reduce, accept, transfer or treat as a priority.
01Security baselineScope, business assets, supporting assets, feared events and the baseline of measures already in place.
02Risk sourcesRisk source / target objective pairs: who might target you, with what motivations and what resources.
03Strategic scenariosHigh-level attack paths through the ecosystem and stakeholders, providers included.
04Operational scenariosTechnical modes of operation, vulnerabilities exploited and likelihood of the paths selected.
05Risk treatmentPrioritised measures, owners, budgets, lead times, then assessment of the residual risk and follow-up.
→DecisionThe output is not a table: it is a trajectory you can decide on, defensible before the committee.
04 · BUSINESS CONTINUITY
BIA → BCP → DRP: the timeline of an interruption
The BIA identifies what is vital. The BCP organises continuity in degraded mode. The DRP prepares technical recovery. Placed on the timeline of an incident, these plans can no longer be confused.
01Before · BIACritical activities, interruption impacts, dependencies and RTO / RPO objectives. The foundation.
02T0 · InterruptionThe incident occurs: normal operation stops, the crisis begins.
03During · BCPKeep essential functions running in degraded mode: the whole organisation, not just IT.
04Recovery · DRPRestore systems and data while meeting the RTO / RPO. The technical side.
05After · Tests & lessons learnedA plan that has never been tested is a hypothesis, not a guarantee. Gaps, actions, keeping it up to date.
06Result · Continuity maintainedA controlled return to normal, evidence kept, decisions documented.
05 · NO MORE CONFUSION
Four distinctions that change the decision
Using these terms interchangeably already means losing precision. Clarifying them means knowing where to start, and what you really expect from each arrangement and each role.
BIA · BCP · DRP
BIA: identifies what is vital and the tolerances to interruption. The foundation, without which a plan is built blind.
BCP: organises how essential activities are kept running in degraded mode. It goes beyond IT: it concerns the whole organisation.
DRP: restores systems and data after a disaster. The strictly technical side.
RTO · RPO
RTO: maximum acceptable interruption time: how quickly a service must be restored.
RPO: maximum tolerable data loss: how far back in time it is acceptable to go.
Two measurable objectives, set in the BIA, which then determine the sizing of backups, redundancy and the DRP.
Audit · Risk analysis
Audit: observes the state of control and the gaps: where you stand at a given moment.
Risk analysis: links these gaps to credible scenarios, business impacts, decisions and residual risks. One observes, the other leads to a decision.
CISO · DPO
CISO: steers the security of the information system: protecting the business, access and availability.
DPO: oversees the compliance of personal data processing (GDPR); an independent function. Two responsibilities that work together without being confused.
06 · NIS 2
A wider scope, accountability that goes up to the executive
NIS 2 extends the European cybersecurity framework to several thousand organisations in France, across some eighteen sectors. The transposition law is taking shape: waiting for “the date” is a bad calculation, as compliance work takes months.
Essential entities
The most critical sectors: energy, health, transport, water, digital, public administration… Enhanced supervision and full obligations, with possible ex ante supervision.
Important entities
A wider scope: food, manufacturing, waste management… Proportionate obligations and supervision mostly exercised ex post.
The obligations, in summary
Risk management & hygieneRisk analysis, backups, MFA, access management, logging.
Supply chainSecurity of the critical providers and suppliers you depend on.
Incidents & notificationDetection, handling and notification of significant incidents to the authorities.
Business continuityBackups, crisis management and continuity / recovery plans (BIA, BCP, DRP).
Accountability of management
A major new feature: management bodies must approve and oversee risk management measures. Cybersecurity stops being a purely technical subject.
Where to start
Determine whether you are affected (sector, size, role), map your priority risks with an EBIOS RM analysis, measure the gap with an audit, then structure governance and reporting.
07 · DORA
Digital operational resilience for the financial sector
Applicable since 17 January 2025, the DORA regulation imposes a demanding resilience framework on the financial sector (and its IT providers). In France, supervision falls in particular to the ACPR and the AMF, the French banking and financial markets supervisors.
Directly subject
Financial entities
A very wide range of players falls within the scope:
- Banks, insurers, asset management companies
- Payment and electronic money institutions
- Crypto-asset service providers (PSAN)
In scope indirectly
Their ICT providers
A crucial point: DORA also targets IT service providers.
- Hosting providers, software vendors, cloud providers
- Through the contractual requirements imposed by their financial customers
- Register of contracts, compliant clauses, exit strategy
The five pillars
ICT risk management
Governance, mapping, protection and continuity measures, steered at management level.
Incident management
Detection, classification and notification of major ICT-related incidents.
Resilience testing
Regular testing, up to advanced testing (TLPT) for the most significant players.
ICT third-party risk
Register of contracts, contractual clauses, concentration assessment, exit plan.
Information sharing
Voluntary exchange of cyber threat intelligence between financial entities.
The most underestimated point: third parties
Many organisations discover that they do not control their dependence on a handful of critical suppliers. DORA makes it a top-priority subject: register, compliant clauses, concentration and exit.
08 · GDPR · 72-HOUR CNIL NOTIFICATION
From data to evidence, 72-hour notification included
GDPR compliance only has operational value when it translates into a record that is kept up to date, real impact assessments and the ability to notify a breach on time, without empty declarations or cosmetic compliance.
Record of processing activities
Processing activities, purposes, sensitive data, access and processors, mapped and kept up to date.
Impact assessments
DPIAs on high-risk processing: measure before processing, document the decisions.
72-hour notification
A data breach must be notified to the CNIL, the French data protection authority, within 72 hours. A countdown that is prepared before the incident, not during it.
DPO & security
Coordination between the DPO and the security function: evidence of decisions, incident management, data subjects’ rights.
09 · WHAT WE DO NOT PROMISE
A framework guides; it guarantees nothing on your behalf
A well-maintained framework reduces improvisation and makes trade-offs easier. It replaces neither testing, nor decisions, nor the facts on the ground. Here is what we do not promise.
Compliance linked to real practices
No label replaces measures that are actually applied. A useless document, never put into practice, sometimes increases the risk instead of reducing it.
No zero risk
A risk analysis guarantees neither the absence of vulnerabilities nor the absence of compromise. It is a structured reading at a given moment, to be revised after any incident, change to the information system or new dependency.
No untested plan
A plan that has never been tested gives an illusion of control. And the decision remains with management: Galyct Pro informs the trade-offs; accepting the risk and allocating resources are up to the organisation.
See your frameworks applied to your context.
A 30-minute live demo on ISO 27001, NIS 2, DORA, GDPR, EBIOS RM or BCP / DRP, or start on your own with the free executive diagnosis. No commitment.