Security that obeys the law. And protects the business.
LGPD compliance, risk management and implementation of controls based on ISO 27001, NIST CSF and CIS Controls. We turn a legal obligation into a competitive advantage.
The ANPD has been issuing fines since August 2021
Brazil's National Data Protection Authority has begun enforcement. Companies that collect personal data from Brazilian customers must be compliant.
What we deliver
GRC is not just documentation. It is the structure that connects technical security with governance and regulation.
LGPD Compliance
- Personal-data flow mapping
- Records of processing (ROPA)
- Impact assessment (DPIA)
- Privacy policies and notices
- Employee training
- DPO support (or DPO as a Service)
Risk Management
- Risk identification and assessment (ISO 31000)
- Risk matrix per critical asset
- Risk-treatment plan
- Periodic review and updates
- Integration with pentest and SOC
- Executive report for the board
Frameworks and Standards
- NIST Cybersecurity Framework (CSF)
- ISO/IEC 27001, audit preparation
- CIS Controls v8
- PCI DSS (for finance/e-commerce)
- BCB Resolution 4.893 (Open Finance)
- Gap analysis and compliance roadmap
Policies and Governance
- Information Security Policy (ISP)
- Data Classification Policy
- Incident Response Plan (IRP)
- Business Continuity Policy
- Access control and identity management
- Vendor-contract review
Our GRC methodology
Initial Diagnostic
Complete gap analysis, we map where your company stands against the chosen framework and what must change for compliance.
Risk Prioritization
We do not treat every gap equally. We prioritize by business impact and likelihood, you invest where it matters.
Control Implementation
Policies, processes and technical controls implemented with follow-up. Not just documents, real change.
Training and Culture
Compliance that does not live in people's heads does not exist. We train every level, from the CEO to the operational team.
Continuous Monitoring
Periodic reviews, policy updates as regulations change and ongoing support for the DPO/security lead.
Is your company LGPD-compliant?
Schedule a free diagnostic. In 30 minutes we identify the main compliance gaps and the shortest path to compliance.