Essential ITSP
For: one system with a simple architecture
€8,000
Fixed price, excl. VAT. Remote delivery.
- Complete IT risk assessment
- Treatment plan for every risk
- Approval-ready document and workbook
- One scoping workshop
- Delivered in 2 weeks
Your IT Security Plan, ready to sign in 2–4 weeks.
A full IT risk assessment and a plan that treats every risk, each with an owner, a deadline and a residual risk score. Built to ITSRM v1.2, at a price fixed before we start.
- Delivery
- 2–4 weeks for most systems
- Price
- Fixed, from €8,000
- Method
- ITSRM v1.2 and ISO 27005
- Who does it
- A senior consultant with EU security clearance
What is an ITSP?
The approved security document for one system. It answers two questions: where do we stand, and what will we do about it?
- 1. The risk assessment
- Your data and functions are valued for confidentiality, integrity and availability. Threats are mapped, and every risk is scored against criteria you agree.
- 2. The security plan
- Every risk above your threshold gets a measure, an owner, a deadline and the residual risk that remains. Risks you accept are recorded as accepted.
Built for EU institutions, bodies and agencies, their system owners and security officers, and main contractors on EU framework contracts who need cleared delivery.
Fixed price per plan. No day-rate surprises.
Pick the band that matches your system. The price is locked at scoping.
Standard ITSP
For: one production system
€12,000
Fixed price, excl. VAT.
- Everything in Essential
- Prioritised treatment plan
- Two workshops: scoping and treatment
- Support to management approval
- Delivered in 3–4 weeks
Complex ITSP
For: one system with many modules or dependencies
From €20,000
Fixed price, excl. VAT.
- Everything in Standard
- Inherited and shared risks handled
- On-site workshops across teams
- Governance support
- Delivered in 5–7 weeks
Portfolio deal
Ten to twenty plans for one agency, on a shared baseline, over 4–6 months. Plans stay consistent and comparable, at a lower cost per plan. Ask about a portfolio.
Keep Current: €3,500 a year
A plan goes stale when your architecture moves. Once a year we re-baseline the risk study and issue an updated plan for re-approval. Add Keep Current.
All prices in euro, excluding VAT. Remote delivery has no extra expenses. Every package includes 30 days of support after delivery. Payment: 50% on order, 50% on acceptance. Buying through a framework contract? Tell us in the form and we quote to match.
The rules already require it.
For EU entities, an approved cybersecurity plan is a legal duty. An ITSP is how you show it, system by system.
- Regulation (EU, Euratom) 2023/2841
- Every Union entity needs a risk-management framework and an approved cybersecurity plan. Its milestones of April 2025, September 2025 and January 2026 have passed.
- Decision (EU, Euratom) 2017/46
- Article 3(4): IT security must rest on a risk management process that sets security measures at a proportionate cost.
- ITSRM v1.2 is the method
- A plan that skips the method will not survive review. We write to ITSRM v1.2, the language your reviewers expect.
Seven phases, with your sign-off at each one.
You review each phase before the next starts. No 80-page surprise at the end.
System characterisation
Scope, owners and your risk acceptance criteria.
Primary assets
The data and functions the system exists for.
Supporting assets
The hardware, software, people and sites they depend on.
System modelling
Which asset supports which.
Risk identification
Threats and risk scenarios for each asset.
Risk analysis
Every risk scored and compared with your criteria.
Risk treatment
Measures, owners, deadlines and residual risk.
Same method. A fraction of the calendar.
| The usual way | With CL2R Advisory |
|---|---|
| 15–25 consultant-days per plan | 4–5 days of senior time per plan |
| Several months, often across two budget years | 2–4 weeks, including your reviews |
| Junior teams, senior review at the end | One cleared senior consultant, start to finish |
| Billed by the day, rework billed again | One fixed price, rework included |
Where the time goes: writing the document takes hours. The weeks are your workshop, your document intake, your reviews and your approval cycle.
From first call to signed plan.
Scoping call
30 minutes, free. We size your system and agree the package.
Fixed-price offer
In writing within 2 business days. Sign it and the price is locked.
Kick-off
NDA, a workshop, and your architecture and data documents.
Delivery and approval
The plan ready for signature, the workbook and an approval note, plus 30 days of support.
Start your ITSP.
Send the form, book a call or email us. We reply within 24 business hours.
- Free 30-minute scoping call
The fastest route to a fixed price for your system.
Book a consultation - Email
info@cl2r-advisory.com. Put your system name and deadline in the subject.
- Cleared hands only
Sensitive material stays with security-cleared staff from intake to approval.
Request a fixed-price offer
We come back with scope, price and dates.