Question 1

What is NIS2?

Accepted Answer

NIS2 is the EU Network and Information Security Directive, effective from October 2024. It requires essential and important organisations to implement cybersecurity controls and report incidents.

Question 2

Who needs to comply with NIS2?

Accepted Answer

NIS2 applies to organisations in essential sectors (energy, transport, banking, healthcare, digital infrastructure) and important sectors (postal services, waste management, manufacturing, food, digital providers) with more than 50 employees or €10 million in turnover. Member states may extend the scope.

Question 3

What is the difference between red teaming and penetration testing?

Accepted Answer

A penetration test systematically evaluates vulnerabilities within a defined scope. Red teaming simulates a real adversary with specific objectives, without a predefined scope, over an extended period.

Question 4

How long does ISO 27001 certification take?

Accepted Answer

The timeline depends on the organisation's size and existing security maturity. For most mid-sized organisations, the process from gap analysis to certification audit takes between 6 and 12 months. Thorough planning and structured evidence collection can significantly reduce that timeline.

Question 5

What is MDR (Managed Detection and Response)?

Accepted Answer

MDR is a managed cybersecurity service combining threat detection technology with human analysts available 24/7. Unlike a traditional SIEM, MDR includes active response — containment, investigation, and remediation when a threat is detected, not just alerts.

Question 6

What is DORA?

Accepted Answer

DORA (Digital Operational Resilience Act) is mandatory for EU financial entities from January 2025. It requires ICT risk management, resilience testing, and incident reporting.

Question 7

What should we do if we experience a security breach?

Accepted Answer

If you suspect an active breach, immediately call your incident response team. Do not take premature containment actions as they can destroy forensic evidence. Under NIS2, essential and important organisations must notify significant incidents to the competent authority within 24 hours of becoming aware.

Solutions

Company

Sectors

Request a proposal