Dyasol certificate
Regulatory assessment and certificate
You are prepared and want to show it to customers, banks and contracting authorities. We assess your measures under our methodology, which follows the mandatory requirements of NIS2 or DORA one to one. If you meet them, you receive a Dyasol certificate with a number, scope and validity period that anyone can verify on our website.
Scope and price are confirmed in writing before work starts.
Discuss your caseWhen you need this service
- A customer, bank or contracting authority wants evidence that you meet NIS2 (EU cybersecurity directive) or DORA (EU Digital Operational Resilience Act).
- You have prepared your measures and want an independent check before you claim it to others.
- You are bidding for a contract or going through supplier approval and need to show compliance.
The benefit for your organisation
- You show customers and contracting authorities evidence they can check themselves.
- You know exactly which mandatory requirements you meet and which you do not.
- You answer questionnaires and tenders with one document instead of dozens of attachments.
NIS2 · basic level
All applicable mandatory requirements of Articles 20, 21 and 23 of NIS2 and the national law that transposes it.
from €4 900usually 3–4 weeks
NIS2 · extended level
The basic level plus verified good practice: an incident exercise, recovery within the target time, log collection and an external exposure check.
from €6 900usually 4–5 weeks
DORA · basic level
The ICT (information and communication technology) risk framework, incidents, testing and third-party providers under DORA Articles 5–30 and its technical standards.
from €7 900usually 4–6 weeks
DORA · extended level
The basic level plus a scenario exercise, a test of the exit plan for a critical provider and testing beyond the minimum.
from €9 900usually 6–8 weeks
Sample output
Illustration with fictional data — not a real client.
| Requirement | Source | Result |
|---|---|---|
| Management has approved the cybersecurity measures | NIS2 Art. 20(1) | Met: decision of 12 March 2026 |
| Management has been trained within the last two years | NIS2 Art. 20(2) | Met: certificates |
| Process for reporting within 24 and 72 hours | NIS2 Art. 23 | Met: procedure and contacts |
| Restore test from backup with a written record | NIS2 Art. 21(2)(c) and (f) | Not met: re-check within 90 days |
Prices cover one legal entity and up to three critical services. Renewal after 12 months costs about 60% of the original price if the scope has not changed.
What must be covered at each level
The certificate reflects exactly these requirements. We issue it only if every requirement for the level is met, and we guarantee that it matches the result of the assessment. Requirements that do not apply to the organisation are recorded with the reason.
NIS2 · basic levelfrom €4 900
The mandatory requirements of NIS2 Articles 20, 21 and 23 and the national law that transposes it.
- Governance
- Management has approved the cybersecurity measures and oversees their implementation (NIS2 Art. 20).
- Management has been trained within the last two years and staff training is organised (Art. 20(2)).
- Risk
- An approved policy on risk analysis and information system security.
- A risk assessment from the last 12 months with a treatment plan, deadlines and owners.
- An asset inventory with owners.
- Incidents
- An incident procedure with roles and a register.
- Criteria for a significant incident and a process for reporting within 24 hours, 72 hours and one month (Art. 23).
- Continuity
- A continuity and recovery plan for critical services, and crisis management.
- Backups with defined scope, frequency and separate storage.
- A restore test from backup with a written record from the last 12 months.
- Suppliers
- A supplier register with an assessment of how critical each one is.
- Security requirements in contracts with critical suppliers.
- Systems
- Security requirements for acquisition, development and maintenance.
- Vulnerability and patch management with a coverage report.
- A channel for vulnerability reports.
- Effectiveness
- At least one review or internal audit of the measures in the last 12 months.
- People and access
- Basic cyber hygiene rules and staff training delivered.
- A joiner, mover and leaver procedure.
- Access control with periodic review of rights.
- Protection
- An encryption policy applied in scope.
- Multi-factor authentication for remote access, email and administrators.
- Secured communication and emergency channels where appropriate.
- Authority
- Registration or notification to the authority where required.
NIS2 · extended levelfrom €6 900
Everything in the basic level, plus:
- Beyond the basic level
- An incident exercise with management in the last 12 months.
- Recovery of critical systems within the target time, shown by a written record.
- Central log collection and review.
- An external exposure check with critical findings fixed in the last 12 months.
- Privileged access management.
- Network segmentation for critical systems.
DORA · basic levelfrom €7 900
The mandatory requirements of DORA and its technical standards. Small entities under Article 16 are assessed against the simplified framework.
- Governance
- The management body approves and is responsible for the ICT risk framework, with budget and training (Art. 5).
- ICT risk framework
- A documented framework with annual review, internal audit and a digital operational resilience strategy (Art. 6).
- Identification and protection
- An inventory of functions, assets and dependencies; protection and detection measures (Arts 8–10).
- Response and recovery
- Continuity policy and plans with tests; backups and verified restoration (Arts 11–12).
- Learning and communication
- Post-incident review, training and a communication plan (Arts 13–14).
- Incidents
- A process, classification and reporting of major incidents (Arts 17–19).
- Testing
- A testing programme and yearly tests of critical systems (Arts 24–25).
- Third-party providers
- A strategy, the register of information, pre-contract assessment, mandatory clauses and exit plans (Arts 28–30).
DORA · extended levelfrom €9 900
Everything in the basic level, plus:
- Beyond the basic level
- A scenario exercise with management.
- A tested exit plan for a critical provider.
- Testing beyond the minimum programme, for example scenario-based tests.
- Participation in threat information sharing (Art. 45).
The certificate is also included in
- The annual programme — if the mandatory requirements are met at the end of the year.
- The readiness and evidence pack — if the gaps are closed within 90 days of the report.
- Delivering the DORA plan — after a successful assessment once the work is done.
How it works
- We agree the scope: the legal entity, services, systems and level. You receive a written quotation.
- You send the documents on our list and give us access for the checks.
- We review documents, talk to the people responsible and check selected measures in place: settings, multi-factor authentication, backups and recovery.
- You receive a report. If a mandatory requirement is not met, you have 90 days to fix it and we re-check only that.
- A second specialist reviews the report and decides on issuing the certificate.
- We issue the certificate in English and Bulgarian, the badge for your website and the record on the verification page.
What you receive
- A report: which requirements are met, the gaps and the evidence behind each.
- A Dyasol certificate in English and Bulgarian, signed by the managing director and valid for 12 months.
- A badge for your website and documents.
- A record on the certificate check page: who holds it, scope, level, validity and whether it is valid today.
How we assess
- Every mandatory requirement has a precise legal source: article, paragraph, point. Good practice appears only in the extended level.
- A self-assessment or a completed questionnaire is not enough. For every requirement we check evidence: a document, record, setting or test report.
- An unmet mandatory requirement is not offset by a good overall score.
- If a requirement does not apply to you, we record why.
- If we were involved in the implementation, the assessment is done by a specialist who was not, and this is shown on the verification page.
- The methodology is versioned. When the law or its ordinance changes, a new version follows.
Validity, suspension and withdrawal
- The certificate is valid for 12 months.
- You tell us within 30 days about a significant incident or a material change in scope.
- If an incident shows that a measure in scope does not work, or the badge is used misleadingly, we suspend the certificate. The suspension shows immediately on the verification page.
- If the cause is not fixed within 60 days, the certificate is withdrawn.
Boundaries
- This is a private certificate issued by Dyasol under its own methodology, which strictly follows the regulatory requirements and how they are met.
- It is not accredited certification, not approval by a competent authority and does not replace management’s responsibility under the law.
- The certificate applies at a stated date and to the described scope. It does not guarantee that no incident will occur.
- You pay for the assessment. We issue a certificate only if the requirements are met.
General information, not a legal opinion.