CARMINIUM

Risk never stays where it starts.

One missed patch. One vendor outage. One overlooked clause.

Small events find each other.

Alone they are incidents. Linked, they are a cascade.

ENTERPRISE OPERATIONAL ICT COMPLIANCE

We trace every path a risk can take to your goals.

Cascade scenarios, mapped from first event to final impact.

CARMINIUM

Risk, held on one thread.

Advisory and analytics for SMEs under DORA and NIS2. Proportionate to your size, tied to your goals.

Request a consultation See the method

THE PROBLEM

A cascade in three acts.

A password is phished on a Tuesday. By Thursday it is downtime, then a breached SLA, and your largest client is rereading the exit clause. None of those steps announced themselves. Each one was only visible from the step before. Carminium exists for the space between the steps. We map how risk travels through your business, from a single event to the goals it can reach, so you see the whole path, not the surprise at the end of it.

WHAT WE DO

Three ways in. One thread through.

Risk Advisory

A risk framework sized for a company your size. Registers, owners, appetite, and reporting that fit how you actually work. Built with your team, not dropped on them.

Cascade Analytics

Our core craft. We model how single events chain through systems, suppliers, and processes until they reach your goals. Every scenario gets a path, a likelihood, and a cost.

DORA & NIS2 Readiness

A gap assessment against the articles that apply to you, then a plan that closes them in order of harm. Evidence the auditor can open, not a binder that gathers dust.

HOW IT WORKS

Trace. Tie. Hold.

  1. 01

    Trace

    We sit with your team and map what matters: goals, systems, suppliers, obligations. Then our AI traces the cascade paths a risk can take to reach them, and we walk through every one with you.

  2. 02

    Tie

    Every path gets an owner, a control, and a trigger. The loose ends get tied before they can travel.

  3. 03

    Hold

    A quarterly cadence keeps the map current: testing, monitoring, and one report your board can read in ten minutes.

TRY IT

Pull the thread.

Press and hold the knot. This is what we do to a tangle.

RISK GOAL

WHAT YOU LEAVE WITH

  • A living risk register your team actually uses.
  • A cascade map from your systems to your goals.
  • A DORA and NIS2 gap plan, ordered by harm.
  • First access to our platform for investigating cascade scenarios.
  • One system that will carry your whole risk process.

STRAIGHT ANSWERS

The questions we hear first.

Maybe, and maybe through the back door. Even a forty-person firm lands in scope when it supplies an essential entity or serves financial clients. We check your scope in the first conversation and tell you plainly either way.

Neither can most of our clients. That is the point. Fixed scopes, proportionate frameworks, and no fifty-page decks you will never open.

So we designed around it. Workshops in half days, drafts we prepare and you approve, and a cadence that costs your people hours a quarter, not weeks.

Good, that is a start. A list tells you what could go wrong. A cascade map tells you what it would break. We upgrade the first into the second.

THE FIRST STEP

Start with one conversation.

Forty five minutes. You bring how the company makes money and what keeps you up at night. We bring a first sketch of your risk paths and a plain answer on your DORA and NIS2 scope. No deck, no obligation.

UNDER UPDATE · AVAILABLE SOON
Booking is being refreshed right now and opens again shortly. Interested? Leave your contact on the enrollment list and you are first in line when the calendar opens.