# Black Fox Security > Penetration testing, security audits and compliance support for ISO/IEC 27001, SOC 2, NIS2, DORA, GDPR, PCI DSS and more, delivered by people. Security should be proactive, not reactive. English is served without a prefix, German under /de and French under /fr, with the same paths. Black Fox prepares organisations for certification audits, attestations and regulatory assessments; it does not issue certificates of compliance itself. It works with long-standing certification partners and coordinates the audit, so a client goes from gap analysis to the official certificate in one engagement; clients can also choose their own certification body, which stays independent of the implementation work. Its certificates of engagement (checkable at /verify) record that an engagement was completed. ## Pages - [Home](https://blackfox-security.com): who Black Fox Security is, the practice areas, how an engagement runs and the contact form - [Services](https://blackfox-security.com/services): every service and framework, grouped by practice, with search and filters - [How we work](https://blackfox-security.com/approach): the engagement workflow and the black, grey and white box testing methodologies - [Contact](https://blackfox-security.com/contact): contact form and e-mail - [FAQ](https://blackfox-security.com/faqs): NDAs, contract types, frameworks and testing guidelines - [Verify a certificate](https://blackfox-security.com/verify): check a Black Fox certificate of engagement by its ID - [Information for AI assistants](https://blackfox-security.com/ai-info): plain-language company summary - [Accessibility statement](https://blackfox-security.com/accessibility): WCAG 2.2 AA aim (not audited), known limitations, how to report a barrier - [Privacy Policy](https://blackfox-security.com/privacy-policy): what personal data the site processes and why - [Cookie Policy](https://blackfox-security.com/cookie-policy): cookies and similar technologies, by consent category - [Terms of Service](https://blackfox-security.com/terms): terms of use of this website - [Imprint](https://blackfox-security.com/imprint): the company operating this website ## Offensive security - [Penetration Testing](https://blackfox-security.com/services/penetration-testing): Penetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes. - [Mobile App Security Testing](https://blackfox-security.com/services/mobile-application-security-testing): Mobile app security testing by Black Fox Security: your iOS and Android apps and the APIs behind them, tested in an agreed scope, with reports and a retest. - [IoT Security Testing](https://blackfox-security.com/services/iot-security-testing): IoT security testing by Black Fox Security: device, firmware, companion app, cloud backend and update process, tested as one product, with reports and a retest. - [RF and Wireless Testing](https://blackfox-security.com/services/rf-and-wireless-testing): RF and wireless testing by Black Fox Security: your Wi-Fi, Bluetooth, sub-GHz links and access cards, assessed under written authorisation and radio rules. - [Physical Security Testing](https://blackfox-security.com/services/physical-security-testing): Physical security testing by Black Fox Security: an authorised on-site review of access control, reception, staff awareness, clean desk and server rooms. ## Compliance and certification - [ISO/IEC 27001](https://blackfox-security.com/services/iso-iec-27001) (ISO/IEC 27001:2022): ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation. - [ISO/IEC 27701](https://blackfox-security.com/services/iso-iec-27701): ISO/IEC 27701 support from Black Fox Security: PIMS scoping, controller and processor roles, privacy risk, records of processing and certification preparation. - [ISO 22301](https://blackfox-security.com/services/iso-22301) (ISO 22301:2019): ISO 22301 support from Black Fox Security: BCMS scoping, business impact analysis, continuity strategies, plans, exercises and certification audit preparation. - [ISO/IEC 42001](https://blackfox-security.com/services/iso-iec-42001) (ISO/IEC 42001:2023): ISO/IEC 42001 support from Black Fox Security: AIMS scoping, AI risk and impact assessment, Annex A controls, internal audit and certification audit preparation. - [ISO/IEC 27017 and 27018](https://blackfox-security.com/services/iso-iec-27017-and-27018): ISO/IEC 27017 and 27018 support from Black Fox Security: cloud control gap assessment, shared responsibility, PII processor controls and audit preparation. - [SOC 2](https://blackfox-security.com/services/soc-2): SOC 2 readiness from Black Fox Security: Trust Services Criteria scoping, gap assessment, control design and evidence preparation for your CPA firm's examination. - [SOC 1](https://blackfox-security.com/services/soc-1): SOC 1 readiness from Black Fox Security: control objectives, IT general controls, gap assessment, control design and evidence preparation for your CPA firm. - [PCI DSS](https://blackfox-security.com/services/pci-dss): PCI DSS support from Black Fox Security: scoping and segmentation, gap assessment, SAQ support, penetration and segmentation testing, and evidence for your assessor. - [TISAX](https://blackfox-security.com/services/tisax): TISAX preparation from Black Fox Security: assessment objectives, VDA ISA self-assessment, gap closure, prototype protection and support during the assessment. - [Cyber Essentials](https://blackfox-security.com/services/cyber-essentials): Cyber Essentials and Cyber Essentials Plus preparation from Black Fox Security: scoping, the five technical controls, gap closure and readiness for the assessor. - [BSI IT-Grundschutz](https://blackfox-security.com/services/bsi-it-grundschutz): BSI IT-Grundschutz support from Black Fox Security: structure analysis, protection needs, modelling, IT-Grundschutz check, gap closure and certification preparation. - [NIS2](https://blackfox-security.com/services/nis2) (Directive (EU) 2022/2555): NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training. - [DORA](https://blackfox-security.com/services/dora) (Regulation (EU) 2022/2554): DORA support from Black Fox Security: ICT risk management gap assessment, incident reporting, digital operational resilience testing and ICT third-party risk. - [GDPR](https://blackfox-security.com/services/gdpr) (Regulation (EU) 2016/679): GDPR support from Black Fox Security: records of processing, DPIAs, security of processing, processor agreements, breach handling and data subject requests. - [EU Cyber Resilience Act](https://blackfox-security.com/services/eu-cyber-resilience-act) (Regulation (EU) 2024/2847): Cyber Resilience Act support from Black Fox Security: essential requirements gap assessment, product security testing, vulnerability handling and documentation. - [EU AI Act](https://blackfox-security.com/services/eu-ai-act) (Regulation (EU) 2024/1689): EU AI Act support from Black Fox Security: AI system inventory, risk classification, governance and documentation for high-risk systems, and security testing. - [HIPAA](https://blackfox-security.com/services/hipaa): HIPAA support from Black Fox Security: Security Rule risk analysis, administrative, physical and technical safeguards, business associates and testing. ## Governance and risk - [Information security audit](https://blackfox-security.com/services/information-security-audit): Independent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire. - [Security risk assessment](https://blackfox-security.com/services/security-risk-assessment): Infrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options. - [NIST Cybersecurity Framework](https://blackfox-security.com/services/nist-csf) (NIST CSF 2.0): NIST CSF 2.0 support from Black Fox Security: current and target profiles across Govern, Identify, Protect, Detect, Respond and Recover, and a plan to close the gap. - [CIS Controls](https://blackfox-security.com/services/cis-controls): CIS Controls assessment and implementation by Black Fox Security: pick your implementation group, measure each safeguard and fix the ones that matter first. - [COBIT](https://blackfox-security.com/services/cobit): COBIT support from Black Fox Security: a governance system for enterprise IT, governance and management objectives, capability assessment and ISO and NIST mapping. - [Policies and procedures](https://blackfox-security.com/services/policies-and-procedures): Black Fox Security writes and reviews your security policies: acceptable use, access control, incident response, suppliers, backup and more, in plain language. - [Third-party risk management](https://blackfox-security.com/services/third-party-risk-management): Supplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations. - [Business continuity and disaster recovery](https://blackfox-security.com/services/business-continuity-and-disaster-recovery): BCP and DRP from Black Fox Security: business impact analysis, continuity and recovery plans, backup and restore testing and tabletop exercises that test the plan. ## Managed security - [Vulnerability management](https://blackfox-security.com/services/vulnerability-management): Recurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting. - [Security hardening](https://blackfox-security.com/services/security-hardening): Security hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security. - [Access reviews](https://blackfox-security.com/services/access-reviews): Periodic access reviews by Black Fox Security: user and privileged access across directories, cloud and key applications, joiners and leavers, audit evidence. - [Continuous compliance](https://blackfox-security.com/services/continuous-compliance): Continuous compliance from Black Fox Security: evidence calendar, internal audits, control testing, policy reviews and surveillance audit support. ## Advisory and response - [Virtual CISO](https://blackfox-security.com/services/virtual-ciso): A virtual CISO from Black Fox Security: security strategy and roadmap, board reporting, policy ownership, audits and customer security questionnaires. - [Digital forensics and incident response](https://blackfox-security.com/services/digital-forensics-and-incident-response): DFIR from Black Fox Security: incident post-mortems, network and storage forensics, reverse engineering, data recovery, response plans and tabletop exercises. - [Security awareness training](https://blackfox-security.com/services/security-awareness-training): Training from Black Fox Security: security and social engineering awareness, incident response and DevSecOps, for staff, developers and management. - [Cyber hygiene training](https://blackfox-security.com/services/cyber-hygiene-training): Practical cyber hygiene training from Black Fox Security: passwords, MFA, phishing, updates, data handling and remote work, tailored to your tools. - [Secure coding training](https://blackfox-security.com/services/secure-coding-training): Secure coding training from Black Fox Security: OWASP Top 10 vulnerability classes, secure design and code review, and security tests, in your team's stack. - [DevSecOps training](https://blackfox-security.com/services/devsecops-training): Hands-on DevSecOps training from Black Fox Security: CI/CD security, infrastructure as code, containers, cloud, supply chain, secrets and threat modelling. - [DevSecOps and secure development](https://blackfox-security.com/services/devsecops-and-secure-development): DevSecOps from Black Fox Security: secure SDLC, threat modelling, code review, security in CI/CD, dependency and secret scanning, and developer training. ## Contact - Website: https://blackfox-security.com - Contact form: https://blackfox-security.com/contact - Email: contact@blackfox-security.com (mailto:contact@blackfox-security.com) - LinkedIn: https://www.linkedin.com/company/black-fox-security - Facebook: https://www.facebook.com/blackfoxcyber ## Other - [Sitemap](https://blackfox-security.com/sitemap.xml): every page in every language - [Security contact](https://blackfox-security.com/.well-known/security.txt): where to report a vulnerability