Is your company ready
for NIS2?

Do you have a procedure for detecting, classifying, and reporting security incidents (including 24h/72h CSIRT notification)?

Is there a tested Business Continuity Plan covering cyberattack scenarios, with regular backup restore tests?

Have you inventoried third-party IT suppliers with access to your systems, and assessed their cybersecurity posture?

Is MFA (multi-factor authentication) enforced for critical systems and remote access (VPN, email, ERP)?

Is there a documented process for granting and revoking access when employees join or leave the company?

Is sensitive and personal data encrypted both in transit (HTTPS/TLS) and at rest? Are mobile devices encrypted or managed?

Do employees and management receive regular cybersecurity training? Has management been briefed on NIS2 personal liability?

Has your company assessed whether it is subject to NIS2, registered with the relevant authority, and maintains documentation for audit?