NIS2 Officer, certified by DNSC

The company fell under NIS2 as an essential entity but had no formalised measures and no designated security officer. Management did not know where to start or what their exposure to sanctions was.

We carried out a full gap analysis against NIS2 requirements, built the set of policies and procedures, implemented the priority technical measures (MFA, segmentation, monitoring, backup) and took on the role of security officer, certified by DNSC, as the single point of contact.

Compliance is no longer a race against the clock, but a maintained process. With a dedicated security officer and clear procedures, the company can respond to DNSC requests and partner requirements with documents, not improvisation, and periodic reviews keep the level of compliance over time.

The hospital processed sensitive medical data but was uncertain about its legal obligations and had a large attack surface: medical and administrative systems on the same network, with no incident plan.

We carried out a risk analysis, segmented the medical systems from the administrative ones, deployed EDR, MFA and immutable backup, and wrote an incident response plan, tested through a practical exercise.

Patient data is now protected through multiple layers, and the staff know how to react to an incident, because they have rehearsed the scenario. The hospital moved from legal uncertainty to a position where it can demonstrate compliance to the authorities, with documentation kept up to date.

The operator worked with dozens of suppliers who had access to systems, with no clear rules and no assessment. NIS2 requires explicit management of supply chain risk, something entirely uncovered.

We introduced security policies for suppliers, a third-party assessment process, granular access control (least privilege) and monitoring of external connections. We centralised identities and removed unnecessary access.

The relationship with suppliers became safer and more transparent: each third party has access only to what it needs and is monitored. The supply chain risk, previously invisible, is now documented and managed as part of day-to-day operations, not a problem discovered at audit.