Certifications we hold ourselves
ISO 27001:2022 and ISO 9001:2015. The requirements we discuss with clients pass an annual audit in our own organisation.
Offer · Cybersecurity
Cybersecurity - from audit and compliance to protecting mission-critical systems
We run security audits, build NIS2 and DORA compliance and protect the systems your business runs on. We hold ISO 27001:2022 and ISO 9001:2015 certifications ourselves - the standards we require of ourselves, we implement for clients.
Cybersecurity services
From audit and regulatory compliance to monitoring and incident response. Every service leads to a concrete result - a report, a remediation plan or a working safeguard.
Gap analysis · remediation plan
NIS2 / DORA compliance audit
Mapping regulatory obligations onto IT processes, gap analysis, remediation plan and auditor-ready documentation. One window for multiple regulations - audit readiness before the inspection arrives.
Learn moreExternal CISO
Cybersecurity Advisory - CISO on demand
An external CISO for organisations without one: security policies, ISO 27001, risk assessment, SOC oversight, incident and IT vendor management.
Learn moreCVSS · OWASP
SAP penetration testing
Penetration tests of ECC, S/4HANA, HANA, BTP, HCM, Fiori environments and RFC interfaces. Report with CVSS scoring and OWASP-aligned recommendations.
Learn moreSecurityBridge Premier Partner PL
24/7 monitoring and response - SIEM / SOAR
SecurityBridge with Microsoft Sentinel, Splunk and QRadar integrations. Cybersecurity-as-a-Service with 24/7 MDR/SOC for SAP environments.
Learn moreNIS2 / DORA requirement
Security training for boards and teams
Cybersecurity workshops for employees, AI Act for C-level, SAP Security for IT teams. Accounted for as fulfilment of the NIS2/DORA training requirement.
Learn moreM&A · ISO 27001
IT due diligence and risk assessment
Review of security, compliance and technical debt before an M&A transaction. ISO 27001-based risk assessment - a report for the board and the PE fund.
Learn moreCybersecurity audit - scope, process and outcome
We start by establishing which regulations and systems apply to your organisation and finish with a report the board can base decisions on and the IT team can start remediation from.
- Stage 1
Scope and regulations
We establish which NIS2, Polish KSC act and DORA obligations apply to your organisation and which systems, sites and processes the audit covers.
- Stage 2
Gap analysis and process review
We compare policies, procedures and controls against the regulations and ISO 27001. Our work follows NIST CSF.
- Stage 3
Risk assessment, including SAP
We assess risk for critical processes and systems. Where finance or production runs on SAP, the audit covers that layer too, with SAP penetration tests where needed.
- Stage 4
Report and remediation plan
A report for the board and the auditor with a prioritised list of actions. We can deliver the remediation plan together with your team.
We go through the same process every year in our own organisation: SNOK holds ISO 27001:2022 and ISO 9001:2015 certifications, so the audit is run by people who also know it from the audited company's side.
Why SNOK
Experience on mission-critical systems
We secure SAP environments that run finance and production. Reference project: 700 SAP users across 3 companies and 5 jurisdictions.
Standards, not improvisation
We work according to NIST CSF and OWASP, with reports ready for the board and the auditor.
Warsaw and all of Poland
Headquartered at Rondo ONZ 1 in Warsaw. We deliver projects on-site and remotely across the country.
Tools
A free assessment you run yourself - the result appears immediately, with no wait for a sales call.
Resources
Further reading for this topic
FAQ - cybersecurity
What does a cybersecurity audit at SNOK cover?+
Gap analysis against NIS2 and DORA, review of policies and processes according to ISO 27001, risk assessment and a prioritised remediation plan. The result is a report prepared for the board and the auditor - with a concrete list of actions, not generic recommendations.
What does the cost of a cybersecurity audit depend on?+
On scope: the number of systems and sites, the regulations that apply to your organisation, and whether the audit should cover the SAP layer and penetration tests. We prepare a quote once the scope is clear.
Does SNOK deliver security audits in Warsaw?+
Yes. SNOK is headquartered at Rondo ONZ 1 in Warsaw, so projects in the capital are delivered on-site. We also work across Poland - at the client site or remotely.
Who is affected by NIS2 and DORA?+
DORA has applied to financial entities since 17.01.2025. NIS2 covers essential and important entities - in Poland its obligations are implemented through the amendment of the national cybersecurity act (KSC). From 02.08.2026 the AI Act requirements follow. We help determine which obligations apply to your organisation and close the gaps before an inspection does.
Does the audit also cover SAP systems?+
Yes - that is our specialisation. We run SAP penetration tests (ECC, S/4HANA, HANA, BTP, Fiori, RFC), deploy SecurityBridge as SIEM/SOAR for SAP and audit licences. Few security auditors go down to the SAP layer - we started there.
How does CISO on demand differ from hiring a full-time CISO?+
It is the same competence without the cost of a full-time role. An external SNOK CISO organises security policies, runs risk assessments, oversees the SOC as well as incident and IT vendor management - scaled to the size of the organisation.
You can check how ready your SAP systems are for the Polish cybersecurity act and NIS2 yourself, free of charge -the SNOK KSC-CHECK assessment