Security governance
Named accountability, written policies and management involvement — with NIS2 placing responsibility explicitly on senior leadership.
NIS2 readiness
Is your organisation ready for NIS2?
NIS2 raises the bar on cybersecurity governance, incident handling and supply-chain risk across the EU. We help with the technical readiness underneath it — the controls, the evidence and the processes — and we are clear about where our part stops.
- Technical readiness
- Evidence you can show
- Not legal advice
- Where you are nowmeasured against the control areas
- What to do firstprioritised, with effort attached
- The controlsimplemented and operated
- The evidencedocumented as you go
Technologies we work with
- Microsoft
- SOPHOS
- Acronis
- HPE
- 3CX
- UBIQUITI
- veeam
The control areas
What NIS2 expects, in plain language
The directive is written in regulatory language, but the underlying expectations are recognisable security practice. These are the areas the technical work falls into.
Risk management
A documented process for identifying, assessing and treating risk, that is revisited rather than written once.
Incident handling
Detection, classification, response and notification — including being able to report inside the required timescales.
Access control
Least privilege, joiner and leaver processes, privileged account control, and access reviewed on a schedule.
Multi-factor authentication
Strong authentication across accounts and remote access, which the directive singles out explicitly.
Business continuity
Continuity and crisis management arrangements that are written down, tested and kept current.
Backup & recovery
Protected, tested backups with documented recovery objectives and evidence that restores actually work.
Supply-chain security
Knowing which suppliers touch your systems and data, and what security is expected of them contractually.
Vulnerability management
Patching, scanning and a defined route for handling vulnerabilities reported to you from outside.
Staff awareness
Security training with a record of who completed what and when — the evidence matters as much as the training.
Cryptography
Encryption in transit and at rest, applied consistently rather than to whichever systems happened to make it easy.
Documentation
Evidence that the controls exist and operate. Under scrutiny, an undocumented control is difficult to distinguish from an absent one.
Scope
We will not tell you whether NIS2 applies to you.
That is not evasiveness, it is accuracy. Scope turns on sector classification, organisation size and national transposition, and getting it wrong in either direction is costly. It belongs with a lawyer or regulatory adviser. What we will do is get the technical side ready, whichever way that determination goes.
- An honest assessment of your current controls against the control areas
- A prioritised plan, with effort and cost attached to each item
- Implementation of the technical controls, by us or alongside your team
- Documentation produced as the work happens, not reconstructed afterwards
- Incident detection and response that can meet a reporting deadline
- Support answering the security questionnaires your customers send you
The reporting clock
If NIS2 applies to you: one example incident
Now
Early warning
Without undue delay, and within 24 hours of becoming aware.
Example: ransomware alert on a file server, 09:14
What has to be ready
- Record when you became aware: the deadlines run from here
- Follow your incident plan: who decides, and who is told
- Ask your adviser whether it counts as significant
How we help you prepare
- Contain it and keep affected systems stable
- Preserve logs and evidence before they roll over
- Start the written timeline from the first alert
What has to be ready
- Whether it is suspected to be caused by unlawful or malicious acts
- Whether it could have a cross-border impact
How we help you prepare
- The technical facts so far: what was seen, where, since when
- Draft wording for the technical points, for you to review
- Evidence gathered and logged as it is collected
What has to be ready
- An initial assessment of the incident
- Its severity and impact
- Indicators of compromise, where available
How we help you prepare
- Technical assessment of scope, severity and impact
- Indicators of compromise extracted and listed
- Timeline brought up to date, draft text prepared
What has to be ready
- Relevant status updates on the incident, when asked
- What has changed since the notification
How we help you prepare
- Timeline and evidence kept current, so an update is quick to write
- A short technical status you can use as the basis
What has to be ready
- A detailed description, with severity and impact
- The type of threat or the likely root cause
- Mitigation measures applied and ongoing
- Any cross-border impact
How we help you prepare
- Root-cause analysis from the logs and evidence
- A dated record of the measures applied
- Draft technical sections for your final report
You and your adviser decide what is reported, and you submit it.
Illustration. Not legal advice — confirm obligations with your adviser.
Readiness Review
What a readiness review involves.
-
Assess
We work through the control areas with you and record what exists today, honestly, including the gaps.
-
Prioritise
Findings are ordered by risk and by effort, so the quick wins are separated from the genuine projects.
-
Implement
We put the technical controls in place — or support your team doing it — in a planned sequence.
-
Evidence
Documentation is produced as the work is done, so you can show what is in place rather than describe it.
Important
What this service is, and what it is not.
CaminhoIT provides technical readiness and implementation support. We do not provide legal or regulatory advice, we do not determine whether your organisation is in scope, and we cannot certify or declare anyone compliant with NIS2. Compliance is an organisational obligation that extends well beyond technology, and where formal legal or regulatory opinion is required you will need a specialist adviser. Anyone in our industry telling you otherwise is selling something.
Where the line sits
- We do: assess technical controlsAgainst the control areas, and write down what we find.
- We do: implement and operateAccess control, MFA, backup, monitoring, patching, response.
- We do: produce the evidenceDocumentation and records you can put in front of someone.
- We do not: advise on the lawScope, obligations and liability are for a qualified adviser.
- We do not: certify complianceNo IT provider can. Be cautious of any that offers to.
Why CaminhoIT
The work is worth doing either way.
Almost everything NIS2 asks for is what a well-run organisation should already have: controlled access, tested backups, a way to detect and respond to incidents, and suppliers you have actually assessed. Preparing for it is rarely wasted effort, even if you turn out to be outside scope.
- Honest assessmentgaps named, not softened
- Prioritisedby risk and by effort
- We operate it afternot just a report
- Evidence as we gonot reconstructed later
- Questionnaire helpwhen customers ask
- Clear about limitswe say what we cannot do
Questions
NIS2 questions
What is NIS2, briefly?
NIS2 is an EU directive on cybersecurity that replaces and substantially widens the original NIS directive. It extends to more sectors, applies to many medium-sized organisations that were previously unaffected, places explicit responsibility on senior management, sets expectations around risk management and incident reporting, and requires organisations to manage the security of their supply chain. As a directive it takes effect through each member state's own national law, which is why the detail differs between countries.
Can you tell us whether we are in scope?
No, and we would treat an IT provider who offered to with caution. Scope depends on your sector classification, your organisation's size and how the directive has been transposed into Portuguese law — all legal determinations. We work on the technical readiness underneath, which is the same work whichever way that question is answered.
Our customer has sent us a NIS2 security questionnaire. Can you help?
Yes, and this is now the most common way NIS2 reaches smaller businesses. In-scope organisations must manage supply-chain risk, so they push requirements down to suppliers. We can help you answer the technical questions accurately, identify anything you cannot currently evidence, and put those controls in place. We will not help you answer a question in a way that is not true.
Does being ISO 27001 aligned mean we are ready?
It helps considerably — there is substantial overlap in the control areas, and organisations with a working ISMS usually start from a strong position. It is not the same thing, though: NIS2 has its own expectations, particularly around incident notification timescales and management accountability, and being aligned with a framework is not the same as meeting a legal obligation.
How long does it take to get ready?
It depends entirely on the starting point. An organisation already running managed IT with MFA, tested backups and monitoring may need a few months of documentation and process work. One starting with unmanaged devices, shared accounts and untested backups is looking at a longer programme. The readiness review exists to give you that answer specifically rather than generically.
Can the IT Health Check be used for NIS2?
It is a useful first indication — it covers monitoring, patching, backup, MFA, endpoint protection, access review and incident response, all of which appear in the NIS2 control areas. It is not a NIS2 assessment and does not claim to be. Treat it as five minutes well spent before a proper readiness review, not as a substitute for one.
Want a quick indication before committing to a review? Run the IT Health Check →
NIS2 Readiness Review
Find out how ready you actually are.
A structured review of your technical controls against the NIS2 control areas, with a prioritised plan at the end of it. Technical readiness support — not legal advice.