Integrated practices to protect, govern and scale the business.
Independent, technical and executive assessment, vendor-neutral. Pick a practice and open each solution to see what we deliver.
Continuous protection and proven compliance.
Your environment watched at all times, at the lowest price on the market
Critical detection within 10 minutes, 12 months of searchable logs and 24x7 operation in 12 weeks. No per-volume license, deployment for half a monthly fee and taxes included.
Explore the SOC ISO 27001 and ISO 22301 CertificationFrom the first assessment to the certificate
Information security and business continuity certified in a single program: gap analysis, management system, internal audit and support through stages 1 and 2, led by a Lead Auditor in both standards. And NLC pays for the certification.
Explore the programTwelve practices. A page for each one.
100% of the population, not a sample
Outsourcing, co-sourcing and continuous audit with AI agents.
Open practice Sales Process AuditHow much of your revenue would survive an audit?
From CAC to commission paid: risks, testing, financial impact and an action plan in 10 weeks.
Open practice Risk and Control AssessmentIs your risk matrix still valid?
Updated matrix, key-control walkthroughs and critical-control audit in 11 weeks.
Open practice CybersecurityWhat is your real cyber risk?
8 domains: assessment, IR, surface, pentest, 24x7 SOC, threat intel, human risk and ISO 27001.
Open practice IAM & SoDWho accesses what, and at what cost?
SoD assessment, role optimization and IAM review in up to 6 weeks.
Open practice SAP Licensing Financial GovernanceHow much EBITDA leaks from your SAP contract?
23.2% average reduction, first saving in under 30 days and results-based fees.
Open practice Asset RecoveryHow much have you overpaid suppliers?
Full reconciliation, files per supplier and collection, with a success fee on the amount recovered.
Open practice Continuity & CrisisIf you stop today, when do you recover?
ISO 22301, BIA, BCP/DRP, live tests and crisis management.
Open practice ISO CertificationCertification required? Can you prove it?
ISO 27001 and ISO 22301, from assessment to certificate, with certification paid for by NLC.
Open practice Fastrack Due DiligenceDo you know what you are buying?
Tech, Cyber & GRC for M&A in up to 5 weeks, with cost per deficiency.
Open practice Valuation & Transaction ManagementWhat is it worth, and how much reaches closing?
Independent valuation in 4 weeks and a sale managed through closing.
Open practice GRC, Governance & FinanceFull solutions catalog
ISO 27001, privacy, IT and AI governance, risk, valuation and M&A.
See catalogTrust and Technology
Outsourcing, co-sourcing and on-demand specialists, with continuous auditing by specialized AI agents and conformance with the IIA Global Internal Audit Standards.
Explore the Internal Audit practice Sales Process AuditFrom CAC to commission paid, with measured financial impact
Open dedicated pageIT AuditITGC, ITAC, InfoSec and Cyber
Structural IT and cyber risks.
- IT General Controls (ITGC)Access, change, operations and backup.
- Application controls (ITAC)Automated rules, interfaces and in-system SoD.
- Security & CyberSecurity architecture, processes and operations.
Audit with AI agentsContract financial compliance
Payments made vs. obligations assumed, over 100% of volume.
- ExtractionClauses, amounts, deadlines and obligations from the contract base.
- ReconciliationEach payment matched to the obligation behind it.
- FlaggingUndue, duplicated, mismatched and overdue.
ProcessesProcess and commercial audit
End to end, linking risk to revenue.
- Commercial processMarketing → prospecting → closing.
- Procurement, payables and inventoryControls, approval limits and fraud indicators.
- Enterprise riskIntegrated view across areas and processes.
ComplianceCompliance and integrity program
Assessment, design and audit.
- Program assessmentPolicies, controls and whistleblowing.
- InvestigationsIndependent, evidence-based inquiries.
- Effectiveness auditThe control exists, does it work?
NLC's full cyber approach
Open dedicated pageCyber AssessmentWhat is your real cyber risk?
Independent, technical and executive assessment.
- Cyber risk quantificationReal exposure by critical process and asset.
- NIST CSF 2.0 or CIS Controls maturityScore by function and market benchmark.
- Financial quantificationLoss scenarios in board language.
- Prioritized executive roadmapBy risk, cost and timeline.
Incident ResponseYou've been attacked. Now what?
Containment, safe recovery and root cause.
- Incident response (IR)Playbooks, chain of custody and crisis command.
- Digital forensicsTimeline, initial vector and scope.
- Ransomware readinessPlaybooks and regulatory notification.
- Cyber crisis tabletopSimulation with senior leadership.
Attack Surface ReductionHow many doors are you leaving open?
Fewer attack paths, less impact.
- Risk-based vulnerability managementCVSS + EPSS + KEV.
- External attack surface (ASM)Exposed assets and shadow IT.
- Hardening and baselinesCIS Benchmarks, continuously verified.
- Identity and privileged accessPhishing-resistant MFA and least privilege.
- Backup resilience3-2-1-1-0 rule and immutable copies.
Pentest & Purple TeamCan your environment withstand a real attack?
Controlled exploitation, measured detection.
- External and internal pentestPerimeter, lateral movement and Domain Admin.
- Applications, APIs and cloudOWASP Top 10 / ASVS.
- Purple TeamMITRE ATT&CK TTPs with the blue team.
- RetestClosure evidence and residual risk.
Managed SOC 24x7x365Who watches your environment at 3 a.m.?
Continuous monitoring at the lowest price on the market.
- DetectMITRE ATT&CK-mapped correlation, critical within 10 min.
- InvestigateL1, L2 and L3 triage and root cause.
- RespondPlaybooks that isolate and block in minutes.
- Three optionsEssential, Extended and Full.
- See example and SLA12 months of logs, live in 12 weeks.
Human RiskWould your team spot a scam before clicking?
Employees as the first line of defense.
- Human risk assessmentMost exposed areas and profiles.
- Awareness programAnnual track by audience.
- Phishing campaignsEmail, SMS and QR code simulations.
- Awareness platformTraining and progress per employee.
Threat IntelligenceWhat has already leaked about your company?
Continuous monitoring of brand, data and executives.
- Continuous OSINTDomains, certificates, IPs and targeted executives.
- Exposed credentialsLeaks and infostealer logs.
- Dark web and TelegramInitial access for sale and ransomware.
- Brand and impersonationLookalike domains and fake profiles.
IAM, SoD and role optimization with AI agents
Open dedicated pageISO 27001 Certification ProgramISO 27001 is required. Can you prove it?
From assessment to certificate, with a Lead Auditor.
- ISO/IEC 27001:2022 gapClauses 4–10 and the 93 Annex A controls.
- ISMS implementationScope, policy, roles and SoA.
- InfoSec risk (ISO 27005)Methodology and treatment plans.
- Certification readinessInternal audit and stages 1 and 2.
- See the ISO Certification practiceSix phases, typical timeline of 6 to 12 months.
IAM & SoDWho accesses what, and at what cost?
Access with evidence and no conflicts.
- SoD conflict assessmentSingle or cross-system, with AI agents, over 100% of the data.
- Role optimizationRole mining on actual usage.
- IAM process reviewJoiner, mover, leaver and certification.
- PlatformBacked by NLC | SOD Intelligence.
EBITDA recovered in the SAP contract, with results-based fees
Open dedicated pageData & PrivacyIs your data compliant?
LGPD, privacy and responsible data use.
- LGPD readinessLegal basis, purpose and data-subject rights.
- Data mapping and ROPAInventory, flows and transfers.
- DPO as a serviceAppointed DPO with SLA.
- Processor contractsClauses and vendor due diligence.
Integrated GovernanceWho owns IT, security, AI and crisis?
All under a single structure.
- IT governance (COBIT 2019)Objectives, processes and metrics.
- Security governanceCommittee, policy and reporting.
- RACI, committees and reportingBoard and executive dashboard.
- PlatformBacked by NLC | Governance.
AI GovernanceWho answers for what AI decides?
ISO/IEC 42001 and NIST AI RMF in practice.
- Use-case inventoryWhere AI is used and at what risk.
- AI policy and committeeApproval and veto criteria.
- AI riskBias, hallucination, leakage and IP.
- ISO/IEC 42001 readinessGap analysis and AI management system.
Updated matrix and critical controls tested in 11 weeks
Open dedicated pageRisk ManagementEnterprise risk leadership can see
COSO ERM and ISO 31000 in place.
- ERM designPolicy, appetite and risk register.
- Internal controlsDesign and effectiveness with evidence.
- KRIs and reportingOne Page for the board.
- PlatformBacked by NLC | Risk.
Cases, lifecycle and services
Open dedicated pageBusiness ContinuityIf you stop today, when do you recover?
Continuity proven by testing, not on paper.
- BCMS (ISO 22301)Scope, policy and roles.
- BIA and strategiesRTO/RPO and dependencies.
- BCP / DRP plansOperational, IT and crisis.
- Tabletop and live testReal activation and RTO measurement.
- BCM auditConformance and effectiveness.
Crisis ManagementCrises don't warn you. Who decides?
Structure, authority and communication before the event.
- Crisis structureCommittee, severity levels and authority.
- Scenario playbooksCyberattack, reputation and suppliers.
- Crisis communicationSpokespeople, media and regulators.
- Operational resilienceIntegrated maturity and roadmap.
Tech, Cyber & GRC DD in up to 5 weeks
Open dedicated page Asset RecoverySupplier overpayments back in your cash
Open dedicated pageIT & Cyber Due DiligenceDo you know what you are buying?
Technology liabilities visible before signing.
- IT and architectureLegacy, tech debt and licensing.
- CybersecurityPast incidents and compromises.
- ResilienceRTO/RPO and critical dependencies.
- Liability quantificationPost-deal CAPEX/OPEX to adjust price.
- Day 1 integration100-day priorities.
Independent valuation and a sale managed through closing
Open dedicated pageFinancial AdvisoryWhat is your company worth?
Valuation, transactions and regulatory assurance.
- ValuationDCF, multiples and sensitivity.
- Transaction management (M&A)Modeling and negotiation.
- BCB 666/667 assuranceCyber and continuity for financial institutions.
- Dashboards & AnalyticsPower BI KPIs for senior leadership.
Five recurring pains. Measured results.
Cyber risk without visibility
Average 1st-year ROI · up to −70% attack surface.
Uncontrolled access and SoD fraud
Fraud exposure, with AI agents.
M&A without IT liability clarity
ROI · R$1.2M price adjustment per project.
No continuity plan
Recovery time.
Scattered compliance, no evidence
Fines and provisions.
One single event. Billions lost.
Publicly reported cases, the loss, who disclosed it and when.
Bars illustrate relative order of magnitude between cases.
Which challenge do you want to solve first?
An NLC director will help you prioritize.