Compliance you can defend.
Ready for NIS2. Before the regulator asks.
DACTS is a senior cyber, privacy and GRC consulting boutique. We help European organisations turn regulatory pressure — NIS2, GDPR, EU AI Act, DORA — into structured, auditable programmes their Board can stand behind.
Three moments where a call to us usually pays for itself.
Every organisation lands in one of a handful of situations when regulatory pressure hits. If any of these sound like where you are today, the rest of this page is worth ten minutes.
You're in scope for NIS2 or DORA — and the clock is ticking.
Your organisation has been designated as an essential or important entity, national law is transposed, and management is asking hard questions. You need a defensible plan on the table — not another gap register that sits on a shared drive.
See how we help →Your compliance function is fragmented and creaking.
GDPR lives with Legal. ISO 27001 with Security. DORA is landing on Ops. Your controls overlap, your evidence is duplicated three times, and every audit round starts from scratch. You need one framework — not seven parallel spreadsheets.
See how we help →The Board wants independent assurance — before the regulator does.
Your ExCo or Audit Committee wants a credible, third-party view of where you actually stand — not another self-assessment. You need someone senior enough to challenge the second line, and detached enough to say what's really working.
See how we help →Three ways we engage — each mapped to a real starting point.
Every engagement is scoped to the situation you're actually in — no fixed-menu consulting, no shelfware deliverables. What you get is a senior practitioner alongside your team, working inside your programme.
Regulatory Readiness Programme
We take a regulation — NIS2, DORA, or a combination — and translate it into a scoped, prioritised, evidence-backed programme your organisation can actually deliver.
- Applicability & scope analysis grounded in national transposition
- Gap assessment against the actual regulatory articles, not a generic template
- Risk-based remediation roadmap sequenced against your operational capacity
- Board-ready reporting pack: exposure, remediation plan, indicative cost
- Optional embedded programme lead to run delivery through to closure
Integrated GRC Framework
One control library, one taxonomy, one evidence store — covering GDPR, ISO 27001, NIS2, DORA and the EU AI Act at once. Built to survive audit rotation and reg change.
- Unified control library mapped across all applicable frameworks
- Single risk taxonomy and evidence model, tool-agnostic
- Governance operating model: roles, cadence, escalation paths, KPIs
- Policy architecture rationalised — fewer documents, clearer ownership
- Second-line assurance model and Audit Committee reporting pack
Independent Readiness & Assurance Review
A senior, external view of where you actually stand — designed for the Board, the Audit Committee, or as a pre-audit rehearsal before a supervisory review.
- Independent maturity assessment against NIST CSF 2.0 or equivalent
- Control effectiveness testing on a sampled, risk-weighted basis
- Structured findings pack — issues, severity, root cause, remediation
- Executive summary written for a non-technical Board audience
- Optional read-out session with ExCo, Audit Committee or Risk Committee
Three commitments we make on every engagement.
Senior consulting doesn't need a fifty-page methodology. It needs discipline about what actually matters. These three principles govern every engagement DACTS takes on.
Senior work, delivered by seniors.
The person who sold the engagement delivers it. No junior consultant on-site, no pyramid, no partner-oversight-at-distance. When you buy DACTS, you get twenty years of practitioner experience in the room.
Regulator-ready, not slide-ready.
Every deliverable is built to survive external scrutiny — from a supervisory inspection, an internal audit, or a Board challenge. Clean traceability from regulation to control to evidence. No decorative frameworks.
Capability transfer built in.
We work alongside your team, not around them. Every engagement leaves your people more capable than we found them — with the frameworks, the runbooks and the ownership to sustain the programme after we're gone.
Assess
Applicability, scope, and honest current-state gap analysis. Grounded in the regulation as written — not the vendor's interpretation.
Design
Target operating model, control library, policy architecture, and roles & responsibilities that fit your organisation — not a reference model.
Implement
Hands-on delivery alongside your teams — control build, policy authoring, evidence structures, tooling configuration.
Sustain
Governance rhythm, KRI/KPI dashboards, monitoring cadence, and formal capability transfer so your programme runs without us.
And around all of it: independent assurance. Where the situation calls for it, we design and run second-line testing that gives your Board — and your regulator — a credible view of what's really working.
The frameworks shaping European digital business right now.
We work with the regulations that actually apply to your organisation today — with programme-level depth, not just familiarity with the acronyms.
NIS2 Directive
Cybersecurity risk management, incident reporting, and management body accountability across essential and important entities. National transposition variances handled — including the Dutch Cyberbeveiligingswet.
GDPR
Operational privacy programmes: DPIAs, ROPA, transfer mechanisms, DPO advisory, data subject rights operations, and controller-processor governance.
EU AI Act
AI system inventory, risk classification, prohibited/high-risk analysis, conformity assessment readiness, and governance for general-purpose AI models.
DORA
ICT risk management framework, digital operational resilience testing, ICT third-party risk, and major incident reporting for financial entities.
ISO/IEC 27001:2022
ISMS design, implementation and audit readiness — Lead Implementer-led, from initial gap through Stage 2 certification and continuous improvement.
NIST CSF 2.0
Cyber maturity assessment and target-state design across all six functions (Govern, Identify, Protect, Detect, Respond, Recover) — mapped to your regulatory obligations.
Twenty years of senior consulting, delivered by the person you hire.
DACTS was founded on a simple observation: enterprise clients want senior compliance work, but not enterprise pricing — and certainly not enterprise pyramid delivery.
Vikas Gupta is a senior cybersecurity, risk and compliance leader with over two decades of end-to-end consulting and programme delivery. He has worked embedded within some of Europe's most complex organisations — navigating regulatory change, building security governance frameworks, and translating technical risk into language that resonates at Board and ExCo level.
He spent more than 13 years at Accenture, advising Fortune 500 clients and large European enterprises on cybersecurity strategy, IT risk, data privacy, and compliance transformation across financial services, telecoms, energy, retail, and technology.
He is currently engaged at Ingka Investments as NIS2 Programme Manager, delivering a cross-country NIS2 and NIST CSF 2.0 maturity programme.
Vikas founded DACTS to bring enterprise-grade expertise to organisations of every size — the rigour and methodology of a large firm, delivered with the agility and senior attention only a specialist boutique can offer.
DACTS draws on a small circle of senior practitioners for domain depth, strategic guidance, and second opinions on complex engagements.
Senior Risk & Cybersecurity Governance Leader, 15+ years across EY, McKesson and Booking.com. Currently Senior Manager, Risk Governance at Booking.com. CISA · CIPP/E · CIPM. Based in Stuttgart.
3x founder and legal innovation builder. Founder of Lawtoons and LawForMe. Researcher at The Hague University and Erasmus / TU Delft on AI regulation and public safety. Previously McKinsey, WHO, HiiL. Based in The Hague.
Two decades of senior engagements across regulated Europe.
A partial list of the organisations Vikas has served over 20+ years of consulting delivery — spanning energy, financial services, telecoms, industrials, FMCG, and e-commerce.
Client engagements delivered by the DACTS founder over 20+ years of senior consulting — primarily through Accenture, and via subsequent independent and DACTS engagements. Client names reflect engagement history and imply no ongoing endorsement.
Questions clients actually ask before we start.
How is DACTS different from a Big Four firm? +
Three things. First, the person you hire delivers the work — no pyramid, no junior team on-site. Second, no partner overhead loaded into your fee — you pay for expertise, not for someone else's office in Amsterdam Zuid. Third, we take fewer, deeper engagements — which means real availability when the work matters.
Where you should use a Big Four: statutory audit, global multi-jurisdiction programmes, or when your Board specifically needs a Big-Four name on the report. Where DACTS wins: everything else.
Do we need to change our tools? +
No. DACTS is deliberately tool-agnostic. We work with what you have — ServiceNow GRC, LogicGate, Archer, OneTrust, Vanta, spreadsheets, whatever. The framework and evidence discipline we design fits inside your existing tooling; we don't try to sell you a new platform.
If your current setup is actively holding you back, we'll say so — and help you scope a change. But that's your decision to take, not our fee model.
Which sectors do you typically work with? +
Vikas has 20+ years of consulting delivery across financial services, telecoms, energy, retail, e-commerce, FMCG, and technology. Current engagements skew toward NIS2-scope entities (retail, energy, infrastructure) and DORA-scope financial entities.
We deliberately don't take work in areas where we can't be genuinely senior — no health-tech, no defence, no crypto-native. Better to say no than to fake domain depth.
Can you work embedded, or is it advisory-only? +
Both. Depending on the engagement, DACTS operates as: (a) independent advisor delivering assessments and reports; (b) embedded programme lead running delivery inside your organisation for the duration of a programme; or (c) fractional GRC leadership on an ongoing retainer basis.
The current Ingka Investments engagement is an example of (b) — embedded programme leadership over a 12-month NIS2 rollout.
What's a typical engagement length? +
Independent assessments run 4–8 weeks. Regulatory readiness programmes (NIS2, DORA) typically 6–12 weeks for assessment, then 3–9 months if we run the delivery. Integrated GRC framework builds are 3–9 months in phases. Embedded fractional roles are open-ended.
We're allergic to open-ended time-and-materials work with no defined exit. Every engagement has a scope, a duration, and a written handover.
How do you handle confidentiality and our data? +
Standard mutual NDA at kick-off. Data Processing Agreement where applicable under GDPR Article 28. Client data stays inside client systems wherever possible — we don't extract to our infrastructure. Where we do handle documents, they sit in EU-hosted environments only, with no offshoring.
DACTS is a Dutch BV (KvK 42043063) subject to Dutch and EU law. Full details are covered in our engagement terms and privacy notice.
Start with a conversation.
Book an intro call.
A 30-minute intro call is free, no obligation. You get a candid view of whether DACTS can help — and if not, a pointer to who can.