IT and Security Audit
An audit is only worth what its evidence can withstand. Avencyx IT & Security Audit delivers independent, accredited audits — statutory, framework-based, and technical — with findings stated by severity and confidence, remediation you can prioritise, and reports written for the regulator that will read them.
For essential and important entities that must be audited under Romania's NIS framework, for organisations that need an independent view of their IT and security posture against a recognised standard, and for leaders who want audit findings to drive decisions rather than sit in a binder.
Audits of essential and important entities under Law 362/2018 and its NIS2 successor, GEO 155/2024, performed and signed by a DNSC-accredited cybersecurity auditor, with the report prepared for filing with the DNSC.
Assessment against ISO/IEC 27001, the NIST Cybersecurity Framework, or CIS Controls, with a gap register mapped to requirements and prioritised by risk.
Review of network, system, and application architecture and of the configuration of servers, workstations, security tooling, and specific platforms — including ERP and OT/SCADA environments.
Black-, grey-, and white-box testing of in-scope applications and infrastructure as part of the audit programme. Standalone penetration testing and red teaming are delivered by Avencyx Advisory & Offensive Security.
Audit of the risk-management system, security policy, and implemented measures; a prioritised remediation plan; and re-verification of fixes so the next audit starts from a better baseline.
Identify in-scope applications, systems, and networks with you, agree the audit standard and rules of engagement, and formalise authorisation before any testing.
Architecture, configuration, and organisational audits combined with technical testing, executed with minimal operational disruption.
Each finding stated as observation, evidence, severity, confidence level, and recommended action — in a report ready for management, auditors, and the DNSC.
A prioritised remediation plan, support for implementation, and re-verification of closed findings.
Every engagement is designed to leave you with outputs you can show — to your board, your auditors, and your regulators.
Essential and important entities under GEO 155/2024 (Romania's NIS2 transposition) are subject to the DNSC's supervision framework, which under DNSC Order 3/2025 includes inspections and audits. Whether your organisation is in scope depends on sector and size; we perform that applicability analysis as the first step.
Audits required under Romania's NIS framework must be performed by cybersecurity auditors accredited by the DNSC. TOP CYBER TECH S.R.L. holds the company attestation and our founder the individual one, so the audit is performed by an accredited auditor and signed under an accredited company.
The scope and methodology; the architecture, configuration, technical, and organisational findings; each finding's evidence, severity, and confidence level; and a prioritised remediation plan. Where the audit is statutory, the report is prepared in the form required for filing with the DNSC.
A penetration test answers "can this be broken, and how?". An audit answers "does the organisation meet the required measures, and can it prove it?" — technical testing is one input among architecture, configuration, and organisational review. Standalone testing is delivered by Avencyx Advisory & Offensive Security.
You receive a prioritised remediation plan; we can support implementation and re-verify closed findings so the improvement is documented, not just declared.