Transform requirements into operational responsibilities and activities.
The NIS2 Directive strengthens the role of management bodies and requires technical, operational and organizational measures proportionate to the risk. The applicability and specific obligations must be assessed with the organisation's legal advisors and against the current national framework; NESQ supports technical readiness and evidence building.
Areas of gap analysis
- governance, approval of measures and risk supervision;
- risk analysis and security policy for information systems;
- incident handling, roles, escalation and reporting capabilities;
- business continuity, backup, disaster recovery and crisis management;
- supply chain security and relationships with direct suppliers;
- secure development, acquisition and maintenance of systems;
- coordinated management and disclosure of vulnerabilities;
- verification of the effectiveness of the measures;
- cyber hygiene, training and awareness;
- encryption, access control, asset and human resources security;
- MFA and secure communications, where appropriate.
Readiness path
- definition of the organizational perimeter and the services involved;
- interviews, evidence collection and technical assessment;
- classification of gaps by risk and dependencies;
- roadmap with owners, resources, deadlines and expected results;
- support for the formalization of policies and procedures;
- exercises, tests and review of indicators;
- preparation of an updateable evidence file.
Management training
The path includes sessions for management bodies oriented towards risk, responsibility, approval of measures, reading of metrics and decisions during an incident. Training is linked to real assets and services, not treated as an standalone compliance exercise.
Deliveries
- executive and technical gap report;
- action log and treatment plan;
- matrix of roles and responsibilities;
- priority procedures and exercise plan;
- set of indicators for management review;
- documentation of the checks carried out.