Security and Compliance Readiness Sprint before the buyer asks

A security compliance assessment measures a product and the processes around it against the standards someone else is about to check, then says what to fix first.

The sprint covers four:

• ISO 27001 practices, control by control
• the buyer's security review, against the questionnaires procurement actually sends
• AI application security, where the product ships AI features
• GDPR and NIS2 obligations, for European operations

You end with a report written for the person who asked for it, and a remediation roadmap ranked by what unblocks the deal.

Seven areas, whatever framework sits behind the questionnaire:

• security policies and controls
• data protection
• incident response
• access control
• privacy
• third-party and vendor oversight
• business continuity

Each one is answered with an artifact rather than a yes: an access review log, an encryption configuration, an audit log, an incident report, a control diagram.

The fee is fixed to the scope, and both are in writing before we start.

Scope is what moves it: a single product against one buyer's questionnaire is not the same work as a multi-environment estate read against ISO 27001 and NIS2 together. The number comes on the scoping call, once we know which of those we are quoting.

The timeframe is set at scoping, in writing, once we know the product and the standards in scope.

Scope decides it. One product against one buyer's questionnaire is short; several environments against ISO 27001 and NIS2 together is not, and you will know which of those you are before you sign rather than after we have started.

No, and anyone who tells you otherwise is overselling.

Roughly 70 to 80 percent of NIS2's basic security requirements are very likely met by an ISO 27001 practice (Reed Smith, January 2026), so the certificate carries you a long way. Entity-specific registration, reporting and governance duties sit outside it.

unicrew maps where your ISO 27001-aligned controls already meet NIS2 against your actual classification, and where they do not. We work the remaining distance with you.

Read-only access to the code, the infrastructure configuration and whatever policy documentation exists, plus the questionnaire or audit letter that prompted the review.

NDA before any access. For the assessments and audits we work from read-only, least-privilege access, agreed with your technical contact before anything starts.

Yes. Where your product ships AI features, the review covers them by default.

We look at prompt injection, at what a model can leak from your data or another tenant's, at who and what can reach the model, and at what gets logged when it is used. unicrew builds and runs its own AI products, so these are questions we have already answered for our own customers' data.

If the AI features are the only thing you need reviewed, we scope the sprint around them alone.

Yes, as a separate engagement, and nothing about the sprint depends on your taking it.

The sprint ends at the assessment and the roadmap. From there our security engineering and delivery teams can execute the remediation, or your own team can work from the same document; cybersecurity consulting is where that work lives. Because we hold ISO 27001:2022 ourselves, the fixes we recommend are ones we have had to implement in our own environment.

A named owner who can arrange access, and a few hours from the people who already know the answers.

• short interviews with whoever runs engineering and operations
• one prioritization call, with the deal owner and the roadmap owner in it
• decision-makers in the room at the readout

Set-wide, our fixed-scope offers ask between four and ten hours of your team's time in total, depending on the offer. The heaviest part is usually finding documentation that already exists somewhere, and we say at scoping which documents actually matter.