A concrete place to start
Async incident record review
Fixed scope and fixed price, agreed before work begins. About two weeks from receiving the material.
For engineering leaders working under NIS2. A significant incident is reported in phases: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within one month. The review answers one question: could you reconstruct and report a real incident in time, from what you actually record?
The work: You share two or three past incident reports or post-mortems, and exports of your catalogue and ownership data. I trace each incident through five timestamps, from start to root cause resolved, and five lookups, from owner to who would make the reporting call. Each is marked recorded at the time, reconstructed afterwards, or unknown. No interviews needed.
You leave with: A short written assessment of where the chain breaks against each deadline, and the decisions to take. The same gaps lengthen ordinary incidents, so the findings are useful beyond reporting. Optional walkthrough.
I do not determine whether an organisation falls under NIS2 or whether an incident was legally reportable. I show whether its own record could support that decision, and the report, in time.