What it involves
We work out whether it applies to you —it applies to plenty of companies simply for supplying another one that is in scope—, review the required measures on risk management, continuity, supply chain and incident notification, and build whatever is missing. Includes the 24-hour notification procedure, which is where almost everybody ends up late.
