🛡️ Pentest from €539 · Compliance from €89. See All Services →
Optimum Web
NIS2NIS2ISO 27001SOC 2DORACR-NIS2-03

Risk Analysis & Information Security Policy

Risk analysis + Information Security Policy covering 5 frameworks at once. Threat identification, risk scoring, treatment plan, formal policy document. €449, 5-7 days.

Risk Analysis & Information Security Policy by Optimum Web is a fixed-price compliance service covering NIS2 Article 21(2)(a) — Risk analysis and information system security policies. It costs €449 with 7–10 business days delivery by senior security engineers. Risk register with threat identification, likelihood, impact, and risk scores. 14-day warranty included.

€449
Fixed price, VAT excluded
7–10 business daysSenior only
Risk register with threat identification, likelihood, impact, and risk scores
Risk treatment plan — prioritized remediation roadmap
Information Security Policy document (20-30 pages)
Compliance mapping: NIS2 Art.21(2)(a), ISO Cl.6.1.2, SOC CC3.1, DORA Ch.II
🛡️
14-Day Warranty
If the delivered pack does not match your ISMS scope and Statement of Applicability, we rework it at no cost, or refund in full within 14 days of delivery.

Secured by PayPal · 256-bit SSL encryption

or order without payment
+373 22 843569
PayPal · SSL
👨‍💻 Senior only
14-day warranty
🆔 CR-NIS2-03

This Service Covers

GDPRArticle 35 — Data Protection Impact Assessment
NIS2Article 21(2)(a) — Risk analysis and information system security policies
ISO 27001Clause 6.1.2 — Information security risk assessment
SOC 2CC3.1 — Risk assessment process
DORAChapter II — ICT risk management framework

What You Get

Comprehensive risk analysis of your IT infrastructure and creation of formal Information Security Policy. We identify threats (external attacks, insider threats, system failures, supply chain risks), assess likelihood and business impact, calculate risk scores, and create a prioritized treatment plan. The resulting Information Security Policy document covers: scope, roles & responsibilities, acceptable use, access control principles, incident management, and continuous improvement. Covers NIS2, GDPR, ISO 27001, SOC 2, and DORA requirements simultaneously.

Who Needs This

  • Companies subject to NIS2 that need a formal risk analysis and security policy
  • Organizations pursuing ISO 27001 certification (mandatory Clause 6.1.2 requirement)
  • Businesses without any formal Information Security Policy document
  • Companies preparing for SOC 2 Type II audit needing CC3.1 evidence

How It Works

  1. 1
    Scope

    Define assets in scope, identify stakeholders, gather system documentation

  2. 2
    Risk Assessment

    Identify threats, assess likelihood and impact, calculate risk scores

  3. 3
    Treatment Plan

    Prioritize risks, define mitigation actions with timelines and owners

  4. 4
    Policy Delivery

    Information Security Policy document + risk register + compliance mapping

ONGOING COMPLIANCE

Don't Want to Think About Compliance Every Quarter?

Compliance-as-a-Service: €729/month. Quarterly reviews, scans, documentation, and security questionnaire support — as an extension of your team, not a replacement for your compliance owner.

Start CaaS — €729/month

Ready to Start?

€449 · 7–10 business days · 14-day warranty

+373 22 843569

Secured by PayPal · 256-bit SSL encryption

or order without payment

Want ongoing compliance? Compliance-as-a-Service — €729/month

Learn more
Read verified client reviews on Clutch →

Frequently Asked Questions

How is this different from a penetration test?+
A penetration test finds specific technical vulnerabilities. This risk analysis takes a broader view: business risks, process risks, people risks, not just technical weaknesses. The pen test is one input to the risk analysis, but not the whole picture.
Do we need this for NIS2 compliance?+
Yes. NIS2 Article 21(2)(a) explicitly requires 'policies on risk analysis and information system security.' This service produces exactly those artifacts.
What risk methodology do you use?+
ISO 27005 risk assessment methodology, which is the standard for ISO 27001. Risk scores are calculated as Likelihood × Impact with a 5×5 matrix. The methodology is documented in the deliverables.
Can the Information Security Policy be used for multiple frameworks?+
Yes. We write the policy to satisfy NIS2, ISO 27001, SOC 2, and DORA simultaneously. Each section includes cross-references to the relevant framework requirements.
How often should the risk assessment be updated?+
Annually, or when significant changes occur (new systems, new threats, business changes). We recommend our Quarterly Compliance Review (CR-GDPR-16) to track risk changes between annual assessments.

Service page last reviewed 15 August 2026 by the Optimum Web compliance team.

Also Relevant

ISO 27001

Risk Assessment & Treatment Plan

€449 · 7–10 business days
NIS2

Incident Response Plan

€359 · 5–7 business days
DORA

DORA ICT Risk Assessment

€539 · 7–10 business days
ISO 27001

ISO 27001 Readiness Assessment

€539 · 7–10 business days
+373 22 843569

Secured by PayPal · 256-bit SSL encryption

or order without payment
📞Call Us💬Get Free Quote