Q-Secur is an independent firm active in information security and artificial intelligence. Audits and training are what we do. We help organisations in critical sectors build and audit their management systems (ISO 27001, ISO 42001), and stay on top of risk and regulatory compliance. Our courses lead to certification by TRECCERT, which is accredited by ANAB under ISO/IEC 17024. Our experts come from the field, and our auditors are qualified by recognised certification bodies.
We train on what we audit. Over 1000 audit days and more than 200 assignments have taken us into small and medium sized enterprises and into large organisations. We work throughout Europe, mainly in France, Portugal and Belgium. That proximity matters. The same European text rarely lands the same way on either side of a border, and we stay close to what each national authority expects. Our qualifications are accredited by certification bodies.
Frédéric carries out third party audits for Bureau Veritas, Intertek, DNV and BSI Group, with more than 1000 audit days behind him at major accounts and European institutions. A TRECCERT certified trainer, he helped design the ISO 42001 e-learning course and presents its videos. He works in France, Portugal and Belgium, on information security standards and on sector rules alike, from the NIS 2 directive to HDS certification for health data. Aerospace is his strongest ground, where he covers both the EN 9100 standard and the PART-IS regulation.
The same four values apply on every assignment.
Our auditors are qualified on the most demanding schemes, by accredited certification bodies. No qualification is granted once and for all. The 2026 edition of ISO 19011 deals with auditor competence and with how it is evaluated. It calls for a strict initial assessment against defined criteria, then for continued proof of it, through periodic review and through witnessed audits run by the bodies themselves.
Those qualifications come with mileage, 200+ assignments and 1000+ audit days behind them. We audit start-ups and very small businesses, groups known the world over, and above all SMEs, where we spend most of our time.
Clause 9.2 of ISO 27001 and ISO 42001 requires every organisation to run its audits so that the process stays objective and impartial. No auditor can assess a scope they have a stake in, let alone one they answer for. That rule applies to us before it applies to anyone else. We take on only the scopes where we can stay fully independent, and we turn down the rest.
ISO 19011 makes impartiality an audit principle, the one that underpins the approach and the objectivity of its conclusions, and a criterion for choosing the team. We declare any existing relationship before accepting an engagement, and we never audit a system for certification when we have advised on it.
Auditing a management system means being handed, by design, an organisation's know-how, its trade and industrial secrets, its strategic plans, personal data and sometimes health data. The confidentiality principle of ISO 19011 covers all of it, during the engagement and long after it closes.
In practice, we ask for a non-disclosure agreement before the first document changes hands. Remote audits run on secure tools, and nothing travels through consumer file sharing services. Exchanges are encrypted, and audit evidence is returned or destroyed at closure. It is a firm commitment, and one reason clients trust us.
Auditing gives a wide view of what works and what does not. We see management systems that fit into a few dozen pages and are genuinely alive, and others that fill whole binders and nobody ever opens. That experience is what we bring you, before a single finding is written.
We favour pragmatic solutions, provided they stay complete and effective. A pared down system that leaves a requirement unanswered is not pragmatic, it is incomplete. Simplifying is worth it wherever possible, because a simple system is one that teams actually use. That is also the logic of the risk based approach in ISO 19011, putting the effort where the stake is real.
We work in the most exposed, most heavily regulated sectors. Each sector has its own constraints, but the requirement never changes. Protect the information placed in your hands.
Meters, controllers and business systems exchange data continuously over shared infrastructure. Balancing generation against demand and spotting anomalies are moving to AI. When a model gets it wrong, the consequence does not stay inside IT. A poor demand forecast or a mistaken switching operation unbalances the grid, with a risk of supply interruption, even of a blackout. NIS 2 places the sector among essential entities, with duties to manage risk and to report incidents. ISO 42001 frames the models now driving part of grid operations, and ISO 27090 addresses the threats against them. Certification to ISO 27001 proves these risks are controlled, while EN 18286 concentrates the effort where the regulation puts it, on the AI systems classed as high risk. The audit then focuses on remote access, network segregation and the operation of the installations.
An imaging scan is taken, filed in the electronic patient record, then archived with a certified hosting provider. Every interface between them, every connected medical device and every supplier account widens the attack surface. Once health data is out, the hospital never gets control of it back, and neither does the patient. AI is moving into diagnostic support and patient triage, where the AI Act treats these systems as high risk. Without an impact assessment and continuous monitoring, a model will reproduce the bias in its own training data. EN 18286 concentrates the quality effort there, and ISO 27090 addresses the threats against the models. The regulator expects controls that match the sensitivity of the data. In France, hosting it calls for HDS certification, built on ISO 27001. The audit then focuses on access to records, exchanges with third parties and hosting arrangements.
Core network, operations and billing systems, interconnections and roaming agreements form a single whole that a great many players can reach. A flaw at an equipment vendor travels into production within days, and an outage means subscribers no one can reach and emergency calls that never connect. Anomaly detection and incident response are moving to models, usually bought from a supplier. NIS 2 places the sector among essential entities, with demanding requirements on the supply chain and on incident reporting. The early warning is due within 24 hours. You can now require EN 18286 from any supplier of high risk AI. ISO 27090 covers the threats against those models, and ISO 42001 frames the governance around them. Certification to ISO 27001 remains the common language with customers and authorities alike. The audit then focuses on network monitoring, supplier management and service continuity.
Trains, aircraft, vessels and road fleets run on systems that never stop. Signalling, traffic control, port systems and aircraft maintenance exchange data continuously with operations centres and service providers. When a timetable or a maintenance record is corrupted, nothing leaves the platform, the quay or the apron. Flow planning and predictive maintenance now rely on AI. NIS 2 places the sector among essential entities. Civil aviation applies the PART-IS regulation, which requires operators to manage any information security risk that could affect flight safety. Outside aviation, you can require EN 18286 from suppliers of high risk AI, and ISO 27090 covers the threats against their models. Certification to ISO 27001 gives all of these requirements a common backbone. The audit then focuses on remote access, maintenance and exchanges with service providers.
Processes are driven from control rooms wired into the corporate network. Laboratories work on platforms shared with partners and subcontractors, while formulations and process parameters travel over open systems. Process optimisation and molecule discovery are moving to machine learning, which makes datasets and models the real trade secret. A single leaked formulation can hand a competitor years of research. NIS 2 places the sector among important entities, with the same core duties as essential ones. Prime contractors, for their part, audit their value chain and want data and models secured. Certification to ISO 27001 and ISO 42001 answers both concerns. ISO 27090 covers the security of the models, and EN 18286 applies wherever you supply AI yourself. The audit then focuses on access rights, exchanges with third parties and the protection of process data.
The supply chain is digitally continuous, from the prime contractor down to the tier 3 supplier, and risk materialises through the weakest link. Drawings, design environments and production tools are shared. Drones bring flows of their own to protect, from command links to mission and flight data. AI is entering analysis, surveillance and decision support, which raises two unavoidable questions, sovereignty over data and models, and real human control of them. ISO 27090 now addresses the threats against those models. Prime contractors pass their requirements down by contract, and ISO 27001 has become, in many cases, a condition of market access, with EN 18286 now doing the same for AI. Certification proves, independently, that the information you are trusted with is protected. The audit then focuses on exchanges with partners and on the traceability of what is sent.
Independent audits, from the first gap analysis through to certification, including complex cases with a partial scope or several sites. Every assignment is run by an auditor qualified by accredited certification bodies, under the very rules that apply during a certification audit.
Before entering a certification process, it pays to measure the distance between your organisation and the requirements of the standard. That is what the gap analysis is for, with no certificate riding on the outcome. It gives you a map, an estimate of the effort and an order of priority. This is the point where putting things right still costs the least. The engagement runs as an exchange of good practice, so your teams can ask the questions they would never risk asking during a certification audit. You also receive a structured action plan, prioritised and costed in workload, handed straight to your project manager.
The standards require an internal audit, but it is above all your own steering tool. Many organisations hand it to us for lack of time, or to secure objectivity on scopes where their teams would be both judge and jury. We run it with the same rigour as if your certificate depended on it. You receive a detailed, structured report that brings out your strengths as much as your weaknesses, separates confirmed nonconformities from opportunities for improvement, and ties every finding to the requirement concerned. It feeds straight into the management review and the preparation of the certification audit.
Your suppliers and subcontractors carry part of your risk, and a contractual requirement is only worth as much as the check made on site. A second party audit assesses a provider on your behalf, over the scope that matters to you. That assurance is becoming decisive, because a growing share of your sensitive information is processed, hosted or simply read outside your own walls. The point is to confirm that your providers protect it as rigorously as you do, applying good security practice from access control to incident management, and not only promising it on paper.
This is the certification audit itself, carried out under the mandate of an accredited body. We act there as qualified auditors, and never at a client we have supported in any other capacity. Knowing exactly how such an audit is prepared, run and concluded is what gives the three engagements above their value. We carry out third party audits against ISO 27001, ISO 27701 and HDS for Bureau Veritas (France, Portugal), Intertek and BSI Group. Every assignment follows ISO/IEC 17021-1, which governs the impartiality of certification bodies and the conduct of their audits.
Our audits take in the national transpositions of NIS 2 in Portugal and Belgium.
Our courses lead to certification. We run them mainly as self-learning and e-learning, with classroom and virtual classroom sessions on request. Every registration covers the official course material, the online exam with a second attempt included, and access to an expert for 3 months, who answers your first questions and clears up points of auditing or implementation. Our training catalogue (PDF) sets out the courses, with their duration, format and fees. The TRECCERT examination rules explain how the exams are run. Whether open enrolment or in-house, our training is well regarded and the feedback is excellent. References can be provided on request.
The 2026 edition of the auditing standard has just been published, and it puts the training of experienced auditors back in the spotlight. The course covers the principles of auditing, the behaviour expected of an auditor, the running of an audit programme and the conduct of a full assignment, over 8 hours of training and as many CPD points. Hybrid auditing and the digital skills auditors now need get particular attention. It is essential for certification auditors bringing their knowledge up to date, not least to meet IAQG requirements.
This course covers the standard in full, the principles of auditing, the behaviour expected of an auditor, the running of an audit programme and the conduct of an assignment from end to end. That takes 24 hours of training and earns as many CPD points. It leads to the ISO 19011 Lead Auditor certification, awarded after a 150 question exam and valid for 3 years. We run it in the classroom, in a virtual classroom and as self-learning, illustrated throughout with real situations met on third party audits. It suits internal auditors as much as certification auditors.
Saying that you take information security seriously is no longer enough. Speaking the language of ISO 27001 is the recognised way to prove it. TRECCERT offers 3 certification levels on this standard (Practitioner, Lead Implementer, Lead Auditor), backed by ANAB accreditation. The levels build on one another as your experience grows, and each certificate is valid for 3 years. Sessions are designed and run by a TRECCERT certified trainer, drawing on cases seen during certification audits.
Every ISMS starts with risk management. The Statement of Applicability, the choice of controls and the risk treatment plan all follow from it. Yet it is the part auditors most often find played down, or skipped altogether. We recommend this course to organisations about to set up an ISMS and to those already working towards certification. We run it alongside the ISO 27001 course, and can extend it with tailored support to put your risk assessment in place.
This course is aimed at organisations that build AI tools and at those that rely heavily on them, where a technical choice is now an ethical one too. TRECCERT offers 3 certification levels (Practitioner, Lead Implementer, Lead Auditor), backed by ANAB accreditation. We contributed substantially to it, in particular to the e-learning module, whose videos we present. It is full of concrete examples, invaluable on a standard this recent. We also run these courses in the classroom and in a virtual classroom.
The transposition deadline has passed and the directive now takes effect through national law, in Belgium since October 2024 and in Portugal since April 2026, with France completing its own framework. TRECCERT offers 2 courses on the directive, NIS2 Essentials and NIS2 Practitioner. We run them and set them in your own context. That means your classification as an essential or important entity, the practical duties for risk management and incident reporting, the liability of senior management, and the deadlines that actually apply to you.
The European regulation on artificial intelligence applies in stages, starting with the prohibitions and the AI literacy duty in February 2025, then general purpose models in August 2025, and the bulk of the framework in August 2026. The main deadlines are behind us, and every organisation now needs to know where it stands. The course lasts a few hours and clarifies which obligations fall on you, how systems are classified by risk level, and whether you act as a provider or a deployer.
Published on 14 October 2026, ISO/IEC 27090 addresses the threats specific to AI systems. Training data corruption, model theft, input manipulation, each attack comes with the defences available. This is guidance, not a certifiable standard, and it complements ISO 27001 and ISO 27002. Your current controls do not cover these threats.
On 19 October 2026, the European Commission published the reference to EN 18286 in the Official Journal of the EU, the first harmonised standard under the AI Act. It lets a provider of high-risk AI systems be presumed compliant with Article 17. No certificate is required, but the standard has to be applied and the evidence has to hold up under inspection.
A long collaboration has finally taken formal shape. Our work covers ISO 27001, ISO 27005, ISO 42001, NIS 2 and the essentials of the new edition of ISO 19011. Certifications issued by TRECCERT are accredited by ANAB, a real mark of international recognition. The exam is included in every registration, with a second attempt if needed. References are available on request.
Published on 27 May 2026, the fourth edition replaces the 2018 one and applies with no transition period. It finally defines remote auditing, brings virtual locations into scope and puts AI tools into auditor competence. Our practice and our course material follow this version, and our certification courses carry CPD points. Your report templates still hold.
The two fit closely together. The regulation sets obligations according to how risky the system is, while the standard supplies the management system that holds them in place over time. Since July 2026, the high-risk obligations have moved to December 2027. The time gained is there to build what will be required, and ISO 42001 gives you the frame.
It depends on your size, your sector and how much you rely on your suppliers. Some entities are covered whatever their size. Your classification as an essential or an important entity then sets how far your duties go, the reporting deadlines and the liability of senior management. We go through it country by country, across the French, Portuguese and Belgian transpositions.
A regulation applies directly in every Member State, with no national text in between. That is the case for the AI Act and for PART-IS in aviation. A directive has to be transposed country by country, which is why NIS 2 arrived at different dates in France, Portugal and Belgium. Knowing which of the two you face tells you where your obligations are written and when they take effect.
