Services
Practical guidance for each EU cybersecurity regulation, from scoping to the evidence an evaluator or auditor will ask for.
Core services
Certification, product regulation and the design of the schemes themselves. This is where our standards work pays off most.
- Implementing Regulation (EU) 2024/482 EUCC and Common Criteria Security targets, evaluation evidence and certificate maintenance for vendors certifying ICT products under EUCC. See the service
- Regulation (EU) 2024/2847 Cyber Resilience Act Product classification, Annex I gap analysis, vulnerability handling, Article 14 reporting and technical documentation for CE marking under the CRA. See the service
- Regulation (EU) 2024/1689 AI Act Risk classification, Annex IV technical documentation, quality management and Article 15 security testing for high-risk AI systems. See the service
- Regulation (EU) 2019/881 Certification schemes Scheme rules, protection profiles and evaluation methodologies for governmental and private scheme owners, aligned with the Cybersecurity Act and EUCC. See the service
Also for operators and the financial sector
Entity-level obligations, handled by the same team and mapped to the product and certification evidence you already have.
- Directive (EU) 2022/2555 NIS2 Directive Scoping, Article 21 risk-management measures, incident reporting and supply chain security under NIS2, aligned with Spain's ENS and with the national transposition that applies to you. See the service
- Regulation (EU) 2022/2554 DORA DORA readiness for financial entities and for the ICT and managed security providers that serve them: contract clauses, register of information, TLPT and evidence. See the service
How we work
-
A 30-minute call
Free of charge. We listen to your situation and tell you which rules apply and where the effort really is.
-
A fixed-scope proposal
Scope, deliverables, timeline and a fixed price in writing. No open-ended hours.
-
Delivery with a named lead
The person you speak to is the person who does the work, reading your design and your code. For larger scopes we bring in trusted senior associates under the same confidentiality terms, and you keep a single point of contact.
-
Evidence you can reuse
Everything is mapped to the regulation and the standards, so the next audit, evaluation or customer questionnaire starts from it.
We work directly with you or as a subcontractor of your usual integrator or prime contractor. We do not publish client names or engagement details. Confidentiality is part of the service.
Independence
dephensiva owns no evaluation laboratory or certification body and does not evaluate or certify products. Neither dephensiva nor its founder holds shares in jtsec or Applus+, or has an earn-out with them. We declare any potential conflict of interest before an engagement starts.
What we don't do
We are not a testing laboratory, a certification body or a notified body, and we do not issue certificates. We do not provide GDPR compliance services.
Talk to us
Javier Tallón, founder
We reply within 8 working hours (Madrid time).
We work in English and Spanish.