Products
Compliance
audit
Digital security is the foundation of modern business today, and changes in the law (NIS2/UKSC) are not only new obligations, but above all an opportunity to seal processes and protect the company's most valuable assets. Effective protection against threats allows for the safe development of the organization and building trust in relations with business partners in an era of a growing number of cyber incidents.
The aim of this proposal is not only auditing and identifying gaps, but above all the effective transformation of IT infrastructure and organizational procedures towards modern European Union security standards.
Service scope and deliverables
Stage I: Preliminary audit and entity qualification
Analysis of your organization's status and service scope against NIS2 catalogs, resulting in a formal Legal Opinion defining your regulatory category and obligations.
Stage II: Compliance audit and Gap Analysis
Verification of your actual state against the 10 risk management measures listed in NIS2, resulting in a prioritized Gap Report (critical, important, recommended).
Stage III: Implementation and Security Hardening (optional)
Uprooting identified gaps by inventorying IT/OT assets, implementing MFA, executing network segmentation, establishing Patch Management, creating business continuity plans (BCP/DRP via the 3-2-1 rule), setting up incident paths, and integrating with the S46 system.
Stage IV: Training
Targeted 2-hour online workshops tailored for the Management Board (liability and supervision) and general employees (phishing recognition, remote work, and incident handling).
What the Client Gets (Work Results)
Risk analysis methodology
A proprietary risk assessment model tailored to your specific business processes.
Policies and procedures
A complete set of mandatory NIS2 documents (including data protection, incident handling, and access management policies).
Technical documentation
Penetration test reports (LAN/WAN/segmentation), update schedules, and system hardening instructions.
Business Continuity Plans
Disaster recovery plans (DRP) with specified RTO and RPO parameters for critical services.
Supplier assessment model
Questionnaires and tools for the periodic verification of external business partners.
FAQ
Q:
How does this service formally determine our organization's regulatory obligations?
In Stage I, we verify your status by analyzing your scope of activity to determine if your organization qualifies as an essential or important entity. We cross-reference your operations with the service catalogs indicated in the NIS2 directive and deliver a formal Legal Opinion that provides the full legal justification and defines your exact scope of obligations.
Q:
What specific technical implementations are included in the hardening phase (Stage III)?
Stage III goes beyond documentation to implement robust technical mechanisms. This includes deploying or re-auditing multi-factor authentication (MFA) across key touchpoints (VPN, email, ERP), designing and testing network segment isolation, establishing Patch Management, protecting backups against Ransomware using the 3-2-1 rule, and establishing formal incident escalation paths integrated with the S46 system.
Q:
Does this service address the unique security requirements of production environments (OT)?
Yes. During Stage III, the service explicitly includes an inventory of both IT (office) and OT (production/warehouse) systems, mapping the dependencies between them. This ensures that network segmentation, vulnerability management, and business continuity plans are designed to protect continuous production and logistics processes.
Q:
How are the training sessions delivered, and what topics do they cover?
Training is split into two distinct, 2-hour online sessions. The session for the Management Board focuses on personal and financial responsibility, alongside effective supervision over security management systems. The session for employees provides practical workshops on recognizing phishing, managing secure remote work, and following proper incident handling procedures.
Q:
How can we use the results of a social engineering assessment?
The results from a social engineering assessment can be used to educate your employees about the tactics used by attackers, reinforce security policies, and implement more effective security awareness training. The aim is to enhance your organization's human firewall and reduce the risk of future social engineering attacks.
