Customer due diligence
A large account only signs after checking your security: supplier questionnaire, evidence, contractual commitments. A ready file unlocks the contract instead of delaying it.
Topic · Pass an audit
Prepare a cyber audit with up-to-date evidence
When a customer, an insurer or an auditor asks for information, most of the work lies in finding consistent evidence and linking it to the relevant requirements. Galyct Pro brings this information together, tracks gaps and lets you reuse answers that are already documented.
Understand the risk. Take back control. Stay the course.
Hosted in France with Scaleway · Mistral AI (EU) · usable material, not a decorative pile.
You do not prepare an audit the night before: you document it continuously.
The stress of an audit rarely comes from the actual level of security: it comes from being unable to prove it quickly and cleanly. Policies nobody can find, scattered evidence, answers pieced together in a rush. Galyct Pro maintains a living file (evidence, decisions, gaps and trajectory) so that the demonstration is always to hand, whoever asks for it.
01 · THREE AUDITS, ONE REQUIREMENT
Customer, insurer, certifier: the same question
The forms differ, the expectation is the same: show that the risk is under control and on record.
The insurance questionnaire
Cyber cover and its price depend on your answers. Factual, up-to-date information improves insurability and avoids a nasty surprise when a claim arises.
Certification & the authorities
ISO 27001, NIS 2 or DORA requirements, an inspection by an authority: compliance must be demonstrable, linked to real practices and traceable decisions.
02 · WHAT GALYCT PRO BRINGS
An evidence file that is always ready
We continuously document what you do, and link it to the expected frameworks, so you can present rather than improvise.
Gather
The evidence register
A usable record, not a decorative pile.
- Policies, controls, indicators and approvals in one place
- Decisions, exceptions, accepted risks and incidents on record
- Mapping to frameworks: ISO 27001, NIS 2, DORA, GDPR
- Export of a file you can present to a third party
Close gaps & present
Gaps and trajectory
Know where you stand, and show it.
- Gap analysis by framework or questionnaire
- Prioritised action plan to close the gaps
- Tracking of remediation work and its evidence
- Answers reusable from one audit to the next
03 · THE METHOD
From the requirement received to the file presented
A repeatable path: scope the request, map, gather, close the gaps, present.
1ScopeTarget framework or questionnaire, scope concerned and deadline.
2MapMatch each requirement with your practices and your existing evidence.
3GatherBring policies, controls, indicators and decisions together in the register.
4Close the gapsAddress the gaps through a prioritised, tracked action plan.
5PresentExport a clear, defensible file for the customer, the insurer or the auditor.
6Build on itReuse answers from one audit to the next, without starting from scratch.
04 · WHAT WE DO NOT PROMISE
Preparing for an audit is not guaranteeing it
We make your security demonstrable and your file presentable. The verdict belongs to the auditor, the customer or the body concerned.
Not a certification
Galyct Pro prepares and documents; it issues neither an ISO certificate nor an official attestation. Certification remains the business of an accredited body.
Not a guarantee of success
A solid file puts every chance on your side; it does not guarantee the outcome of an audit, which depends on your real practices and on the auditor’s judgement.
No fabricated evidence
We document what is actually done. Invented evidence or a control that was never applied turns against you on audit day.
Not the technical audit itself
When an in-depth technical audit or a penetration test is required, the Galyct firm takes over. Software and human expertise complement each other.
05 · TO GO FURTHER
Passing an audit relies on compliance and on the firm
Preparation in the software and, if needed, the firm’s expert hands.
Document compliance
ISO 27001, NIS 2, DORA, GDPR, 72-hour notification: the documentary foundation linked to your practices.
See the module →Engagements delivered by people
Audit, EBIOS RM, outsourced CISO/DPO: when expert hands are needed, the firm steps in.
See the engagements →Manage risk
Mapping and EBIOS RM: the analytical basis every auditor looks for.
See the module →Prepare your next audit in your context.
A 30-minute live demo on the framework or questionnaire you are facing. Or start on your own with the free executive diagnosis. No commitment.