Problems it solves
- You do not know whether NIS2 applies to your company or what it requires in practice.
- There is no inventory of critical systems and data.
- Access for former staff and suppliers has not been revoked systematically.
- Your own applications have never been reviewed for security.
What the service includes
Risk assessment
Assets, threats, vulnerabilities and impact, with a clear score and a treatment plan.
Technical NIS2 readiness
Gap analysis against the risk-management measures and technical support for self-assessment and remediation.
Application security
Architecture and code review, checks against OWASP ASVS, dependency management.
Identity and access
Multi-factor authentication, least privilege and periodic access reviews.
Incident response plan
Roles, steps and contacts, including the applicable notification deadlines.
Remediation plan
Measures ranked by risk and cost, with owners and deadlines.
Example solutions
NIS2 gap analysis
Where you stand against the requirements and what to do, in order of risk.
Application security review
Before launch or after an incident.
Access hygiene
Account inventory, MFA and removal of unused access.
Technologies and standards
We work with public frameworks and standards, so results are verifiable and comparable over time:
How we work
First conversation
We learn the problem, the systems you use and your time and budget constraints, and tell you honestly whether we are a fit.
Analysis and proposal
For larger work, a short discovery: scope, proposed architecture and a phased estimate with risks in plain view.
Phased delivery
We build incrementally with regular demos. Scope changes are discussed and estimated before they are made.
Handover and support
Documentation, training and full access to code and configuration. Then maintenance with clear terms, or in-house takeover.
Technical security work does not replace legal advice. For your company's legal classification we recommend confirmation by a lawyer; we cover the technical and organizational side.
What you receive
- Asset and risk register
- Gap report and remediation plan
- Technical policies and procedures
- Incident response plan
- Application security report
Business benefits
Clear priorities
Budget goes to the biggest risks first.
Audit evidence
Measures are documented and can be demonstrated.
Prepared response
The team knows what to do in the first hour of an incident.
Integration with existing systems
Integrations between systems are often the most exposed points. We include them explicitly in the risk assessment.
Security and maintenance
- We work under a non-disclosure agreement with minimal access to your systems.
- Sensitive findings are shared encrypted.
Frequently asked questions
Does NIS2 apply to my company?
It depends on your sector, as listed in the annexes to GEO 155/2024, and generally on company size. Our guide explains the criteria; final classification should be confirmed legally.
Do you run penetration tests?
A penetration test is a separate engagement. We help define its scope and choose a provider, then coordinate remediation of the findings.
How long does a risk assessment take?
It depends on the number of systems and sites. Scope and schedule are agreed before we start.