Skip to content
VDHome
Request a quote

What I need from you

For each service you see up front which information I ask for, and when. General facts are enough for a quote; I ask for confidential documents only after the order, through a secure channel.

How it goes

  1. 1. Request

    You send the general facts below. No documents, no confidential information.

  2. 2. Quote

    Within two working days: scope, exclusions, price and delivery date. On request I sign your NDA first.

  3. 3. Order and exchange

    After your approval I agree a secure way to provide the documents from the second list, never as a plain email attachment.

  4. 4. Delivery and clean-up

    After delivery I delete your documents within the term in the quote and confirm it in writing.

NIS2 gap assessment

Request a quote →

For the quote

General facts, simply by email.

  • Name of the organisation, sector and main activity.
  • Size: number of staff and order of magnitude of turnover or budget.
  • Your NIS2 status if known: essential, important, supplier, or not yet known.
  • Number of sites and whether IT is run in-house or outsourced.
  • Existing certifications or earlier audits (for example ISO 27001).
  • What triggers the question: the law, a customer, the CCB, a deadline.

After the order

Only through the agreed secure exchange, never as a plain email attachment.

  • Organisation chart with the information security roles.
  • List of IT systems, applications and service providers.
  • Existing policies, procedures and risk analyses.
  • Reports of earlier audits or tests, if any.
  • A contact person who can answer or route questions.

Where is your data?

Request a quote →

For the quote

General facts, simply by email.

  • Name of the organisation, sector and size.
  • Rough number of cloud and SaaS services, and the main providers (for example Microsoft 365 or Google Workspace).
  • Whether you process special data: health, minors, financial data.
  • Whether you are a public body or work for one.
  • What triggers the question: a customer, an audit, an exit plan, the news.

After the order

Only through the agreed secure exchange, never as a plain email attachment.

  • List of the services with their administrator or contact.
  • Contracts and data processing agreements of the main providers.
  • Your record of processing activities (GDPR Article 30), if it exists.
  • Earlier transfer impact assessments (TIA), if any.

DPIA and AI Act assessment

Request a quote →

For the quote

General facts, simply by email.

  • Name of the organisation and who the DPO is (internal or external).
  • A short description of the processing or project: what, for whom, why.
  • Whether AI is involved, and if so which application.
  • Rough number of data subjects and whether special categories are involved.
  • The deadline for the DPIA.

After the order

Only through the agreed secure exchange, never as a plain email attachment.

  • The part of the record of processing that covers this processing.
  • Project description, data flows or architecture diagram.
  • Documentation of the supplier or the application.
  • The security measures already in place.
  • Contact with your DPO for the advice on the DPIA.

CRA technical file

Request a quote →

For the quote

General facts, simply by email.

  • Name of the company and your role: manufacturer, importer or distributor.
  • Number of product lines and kind of product: hardware with software, app, software.
  • Whether open-source components are used and how you build (CI, release cycle).
  • Whether you already have a vulnerability process.

After the order

Only through the agreed secure exchange, never as a plain email attachment.

  • Architecture documentation of the product.
  • An export of dependencies or an existing SBOM.
  • Existing risk analysis and the vulnerability process.
  • User documentation and the planned support period.

DORA register of information

Request a quote →

For the quote

General facts, simply by email.

  • Type of financial entity and whether you are part of a group.
  • Rough number of ICT providers and contracts.
  • Whether you have submitted a register before.

After the order

Only through the agreed secure exchange, never as a plain email attachment.

  • List of ICT contracts with the provider details.
  • The mapping of contracts to the functions they support.
  • Last year's register, if any.