Locations

International delivery, with local regulation treated locally

Kellwick works with organisations across the European Union (including Croatia, Cyprus and Malta), the EEA, Switzerland, the Western Balkan candidate countries and North America. The ISO standards are the same everywhere; the laws around them are not. Switzerland is not bound by DORA, Norway follows EEA incorporation, and NIS2 means a different national law in each Member State - so we scope against the rules that actually apply to you.

Discuss your requirements

Market pages

Markets with local context

Each page covers the local regulation, the main buyers and sectors, and how delivery works there.

EU Member StateCyprusISO 27001 implementation and internal audits, DORA gap assessments and vCISO support for CySEC-regulated investment firms, FX brokers, fintech and technology companies in Cyprus.EU Member StateMaltaISO 27001 implementation and internal audits, supplier assurance, DORA readiness and vCISO support for iGaming operators, B2B gaming suppliers and fintech firms in Malta.Outside the EU and EEASwitzerlandIndependent ISO 27001 and ISO 9001 internal audits, supplier assurance and security governance for Swiss companies - including Swiss reporting duties and the EU requirements that reach Swiss suppliers by contract.EU Member StateCroatiaISO 9001 and ISO 27001 implementation, integrated management systems, independent internal audits and ongoing management system support for organisations in Croatia, including NIS2 readiness.EU candidate countriesSerbia, Montenegro and Bosnia and HerzegovinaISO 9001 and ISO 27001 implementation, integrated management systems, independent internal audits and ongoing support for export-oriented companies in Serbia, Montenegro and Bosnia and Herzegovina.North AmericaUnited StatesISO 27001, ISO 9001 and ISO 42001 implementation and internal audits, SOC 2 readiness, NIST CSF 2.0 assessments, CMMC readiness and vCISO services for US companies.

Regulatory status

Geography is not jurisdiction

Which rules apply depends on a country's legal status, not its region. Croatia is in the Western Balkans geographically, but it is an EU Member State.

Regulatory status of the markets Kellwick serves
Status	Countries	What applies
EU Member States	Including Croatia, Cyprus and Malta	DORA, GDPR and the AI Act apply directly; NIS2 applies through each country's national law, on its own timetable.
EEA	Norway	EU acts apply only once incorporated into the EEA Agreement and national law: DORA through the Norwegian DORA Act; NIS2 not yet incorporated (the Digital Security Act implements NIS1).
Outside the EU and EEA	Switzerland	Swiss law applies (Information Security Act, FINMA requirements); DORA and NIS2 reach Swiss firms only through EU customers' contracts or EU subsidiaries.
EU candidate countries	Serbia, Montenegro, Bosnia and Herzegovina	National information security laws, at different stages of alignment with NIS2; EU regulations reach firms through EU customers.
North America	United States, Canada	Domestic and contractual frameworks: SOC 2 attestation, NIST CSF 2.0, CMMC and NIST SP 800-171 for US defence contracts, CPCSC for Canadian defence suppliers. EU deadlines do not apply.

Last verified 16 October 2026 against European Commission - NIS2 and EUR-Lex - Directive (EU) 2022/2555.

Also served

Other markets we support

Norway

Norway's Digital Security Act, implementing NIS1, has been in force since 1 October 2025; NIS2 had not yet been incorporated into the EEA Agreement as of October 2026. Norway's DORA Act has applied since 1 July 2025. We support ISO internal audits, security governance and DORA readiness for Norwegian financial entities and their suppliers.

Last verified 16 October 2026 against Lovdata.

Canada

Bill C-8, including the Critical Cyber Systems Protection Act, received Royal Assent in June 2026 and comes into force in phases; defence suppliers face CPCSC Level 1 self-assessment in selected contracts. We support ISO 27001, ISO 9001 and SOC 2 programmes and vCISO leadership for Canadian companies.

Last verified 16 October 2026 against Government of Canada - CPCSC.

Other EU and EEA countries

Germany, France, the Netherlands, Belgium, Ireland, Spain, Italy, Austria, Poland and the Nordic countries are served remotely, with onsite audit days arranged per engagement. NIS2 transposition differs by Member State - several had not completed it by October 2026 - so applicability is assessed against the national law that applies to you.

Last verified 16 October 2026 against European Commission - NIS2 and EUR-Lex - Directive (EU) 2022/2555.

Delivery

Remote, onsite and hybrid

Remote

Gap assessments, document and evidence review, ISMS, QMS and AIMS management, vCISO reporting and most information security audits. Evidence lives in systems and documents, and interviews work over video.

Onsite

Manufacturing audits, process audits on production floors, multi-site sampling and some board or incident sessions. Onsite days are scoped and priced per engagement, with travel stated separately.

Hybrid

The common case: documents and most interviews remotely, then onsite days for the parts of the scope where the evidence is physical.

How engagements are contracted

Engagements are contracted with Sodasoft LLC, the US-registered company that operates the Kellwick brand. Proposals state the contracting entity, currency and how taxes apply. Kellwick does not operate local offices or local legal entities in these markets, does not provide legal opinions or regulated local representation, and is not a certification body. Work is delivered in English.

Tell us where you operate

Name the countries, sites and standards involved. We confirm what applies, what can be done remotely and where onsite days are needed.

Discuss your requirements Industries

Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.