We will help you implement NIS2, from policies to deploying security solutions. Professional assessment, preparation and ongoing support, all from one provider.
Built for ISO 27001NIS2 DORA
. Under the NIS2 directive, all important and essential entities must not only apply advanced security measures but also ensure business continuity during emergencies, technical failures or cyberattacks. MDP CLOUD helps companies meet every requirement using modern technology and documented processes. Our goal is not only to implement technical measures but also to help build a robust, working and continuously tested continuity framework that is understandable, reliable and auditable.
We use advanced EDR/XDR solutions (Bitdefender, SentinelOne, CrowdStrike) for real-time threat detection, isolation and response.
We automate OS and application updates using MDPCLOUD RMM.
We implement USB, application and system change control (Application Control, Device Control).
We carry out vulnerability analysis and remediation.
We monitor device health, performance and activity history through a centralised management platform.
In our risk analysis we assess both technical threats (using Bitdefender, SentinelOne and CrowdStrike analytics) and business process vulnerabilities.
We build detailed risk tables: threat source, impact level, likelihood and controls.
We create a risk management plan covering mitigation, transfer or acceptance decisions.
We define the review frequency, involve responsible people and recommend solutions based on good practice.
We create an incident management plan with a clear incident lifecycle: identification, classification, analysis, resolution, report.
We integrate technologies that detect threats automatically: Bitdefender GravityZone XDR, SentinelOne, CrowdStrike Falcon, Defender for Office 365.
We set event severity levels, response times (SLA) and responsible people.
We prepare notification templates for customers, internal staff and CERT authorities.
We run annual incident simulation tests involving different departments and technology components.
We compile a list of all critical services, IT systems and business functions, and assess their importance and dependencies.
We define RTO (Recovery Time Objective) and RPO (Recovery Point Objective) targets for each system.
We implement automated backup with Veeam, Microsoft 365 Backup and MDPCLOUD RMM.
We run full recovery tests (files, servers, user environments) at least once per quarter.
We provide the customer with documented recovery instructions and scenarios to follow in case of failure.
We implement multi-factor authentication (MFA), Conditional Access rules and Just-in-Time administrator access through Microsoft Entra ID.
We use group- and role-based access control (RBAC).
We implement an SSO policy with external vendors and partners.
We define how often access is reviewed, and the change and removal processes, including automatic removal of users when employment ends.
We use audit logs and automated reports on access history.
Together with your company we build a supply map covering all third parties that provide IT services (cloud providers, IT partners, software developers and so on).
We assign each vendor a risk level, assessing their security practices, SLA terms and compliance with ISO or other standards.
We create a supply risk management plan covering preventive measures and the allocation of responsibility.
We prepare templates for vendor contractual commitments that include the security requirements of NIS2.
We build a comprehensive cybersecurity awareness plan tailored to the different roles in your organisation.
We deliver training on social engineering threats, password policy, safe data handling and device use.
We run phishing simulations with Bitdefender Human Risk Analytics or other platforms (for example KnowBe4).
We record participants' progress, assess results and prepare audit evidence.
We encourage a security culture in the company: internal posters, emails and security tip campaigns.
We prepare a comprehensive information systems security policy that defines all processes, measures and responsibilities related to IT security.
The policy sets standards for access control, incident response, data protection and supply chain management.
We make sure the policy meets the requirements of NIS2, ISO/IEC 27001 and national supervisory authorities.
We help companies put this policy into practice: assign responsible people, approve procedures and introduce control points.
| Sector | Classification | Examples |
|---|---|---|
Health sector | Essential | Healthcare providers, hospital laboratories |
Digital infrastructure | Essential | Internet and cloud service providers |
Transport | Essential | Air traffic control, water traffic control, rail infrastructure |
Energy | Essential | Electricity, gas and oil pipeline suppliers |
Finance | Essential | Banks, credit institutions, investment platforms |
Digital service providers | Important | Online marketplaces, cloud service providers |
Public administration | Important | Government services |
Manufacturing | Important | Pharmaceuticals, medical devices |
Space | Important | Satellite operators |
Food | Important | Food supply chains |
Postal and courier services | Important | Courier services |
Wastewater and waste management | Important | Water treatment facilities, waste management services |
Providers of public electronic communications services | Important | Electronic platforms, colocation services |
Manufacture of critical products | Important | Critical raw materials |
No. NIS2 requires not only technology but also documented procedures: a security policy, risk analysis, an incident management plan, supply chain assessment, training and more.
Responsibility lies with management. The IT department or an external partner can implement the measures, but decisions, budget and risk tolerance are set by management.
At a minimum: a security policy, risk analysis, incident management plan, business continuity plan (DR), access control policy, training plan and supply chain risk assessment.
We recommend at least once a year. Critical processes should be tested every quarter (for example backup and incident testing).
Yes, and we even recommend it. What matters is that the solutions are properly integrated and that data is stored in the EU or in line with GDPR requirements.
Authorities assess documentation, the allocation of responsibilities, incident logging, preventive measures, supply chain control and evidence of training.
Depending on the type of incident, you must notify the national CERT within 24 or 72 hours. You need an incident classification and notification plan.
The cost depends on your current IT maturity. The technology part (Microsoft 365 Premium, EDR, backup) starts from a few hundred euros per month. Preparing documentation and processes starts from a few thousand euros as a one-off or on a subscription basis.
Yes, many areas overlap. If you already have ISO 27001, reaching NIS2 compliance is much easier, but you still need to review the additional aspects.
You can use an external NIS2 partner who will implement both the technology and the documentation and help you prepare for the audit. This is exactly what MDPCLOUD offers.
Although NIS2 and GDPR have different goals (NIS2 covers cybersecurity, GDPR covers data protection), they are closely linked, because both require a high level of protection and incident reporting.
Organisations must report the incident to the relevant authorities without delay, carry out their incident management plan and take action to limit the impact and prevent similar events in the future.
MDP CLOUD vCISO is an experienced chief information security officer (CISO) on demand: risk management, policies, control implementation, training…
NIS2 projects are led by ISACA- and PECB-certified auditors, security managers and ISO 27001 implementers.
Audit and evidence in line with international information systems audit standards.
Risks are assessed and controlled using the international IT risk methodology.
The service is delivered in line with the requirements of an ISO/IEC 27001 management system.
Security governance, policies and incident processes following the ISACA methodology.
We reply within 1 business day
