/ NIS2 COMPLIANCE
The NIS2 Directive and Hungary's Cybersecurity Act place new obligations on many organizations. Qyntar takes you from establishing whether you are in scope, through gap analysis, to implementing the technical measures, so compliance becomes real protection rather than paperwork.
[ 01 ] / WHAT IT IS
NIS2 is the European Union's cybersecurity directive. It sets stricter risk management, incident reporting and management accountability requirements for organizations in critical and important sectors. In Hungary it is implemented by the Cybersecurity Act. Our service helps you establish whether your organization is affected, what you have to do, and how to do it efficiently. This is not legal advice.
NIS2 (the Network and Information Security Directive 2) replaces the 2016 NIS Directive. It covers far more sectors and organizations, sets stricter requirements and provides for meaningful penalties for non-compliance. The directive distinguishes between essential and important entities, and scope depends mainly on sector and size (generally medium-sized and larger businesses). Establishing whether you are in scope is the first step, because many organizations do not know for sure whether they fall under it.
Article 21 of the directive sets the minimum technical, operational and organizational risk management measures. These include risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, secure acquisition and development, vulnerability handling, assessing the effectiveness of controls, cyber hygiene training, cryptography and encryption, personnel security, access control and asset management, and the use of multi-factor authentication.
Management accountability is new: management must approve risk management measures, oversee their implementation, and can be held liable for failing to comply. Significant incidents must be reported to strict deadlines: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month at the latest. Fines for essential entities can reach 10 million euros or 2% of worldwide annual turnover, and for important entities 7 million euros or 1.4%, whichever is higher. Always check the specifics of Hungarian law against the legislation in force.
Legislation and supporting standards
[ 02 ] / WHO IT'S FOR
Organizations in the affected sectors, and also those who meet the requirements indirectly through large customers.
Energy, transport, banking, financial market infrastructure, healthcare, drinking water, digital infrastructure, ICT services, public administration, postal services, waste management, chemicals, food, manufacturing and other sectors.
Applicability depends on sector, size and the nature of the service. Our first step is to establish your exact status.
NIS2 extends to the supply chain: in-scope organizations expect security assurances from their suppliers, so the impact can be indirect.
Management accountability reaches a new level. We help ground decisions, document approvals and provide training.
IT and OT security have to be handled together. Compliance covers IEC 62443 and OT segmentation considerations too.
An existing system is a good base, but NIS2 adds expectations (for example on supply chain, incident reporting and management accountability) that call for a targeted gap analysis.
[ 03 ] / WHAT'S INCLUDED
The service is modular: depending on your maturity, we take on the whole journey or only parts of it.
We establish whether your organization falls under NIS2 and the Hungarian Cybersecurity Act, and in what capacity (essential or important).
We compare your current security posture with the Article 21 expectations, measure by measure: what is met, what is partly met and what is missing.
Setting up or reviewing the risk analysis methodology, risk register and treatment plans, in a form your leadership can follow.
Drafting or updating the information security, incident, business continuity and supply chain policies, with an eye to practical usability.
Planning and implementation support for multi-factor authentication, access management, logging, vulnerability handling, encryption, backup and network segmentation.
Building the process, roles and templates to meet the 24-hour, 72-hour and one-month reporting duties. See incident response.
Building a supplier risk assessment methodology, contractual security requirements and an oversight practice.
A briefing and training for management on their responsibilities, evidence gathering, and preparation for regulatory or independent inspection.
[ 04 ] / HOW IT WORKS
We work from priorities and a schedule: first we deal with the greatest risk and the nearest deadline.
An analysis by sector, size and service: whether the regulation applies to you, and which obligations come with it.
From document review, interviews and technical sampling, we identify the gaps against the requirements.
A prioritized plan with owners, deadlines, and cost and resource estimates, shaped for executive approval.
We develop and implement the policies, processes and technical measures, working alongside your own team.
We check control effectiveness, gather evidence and, where needed, run technical tests (such as a penetration test).
An annual review cycle, exercises, training and, if needed, support from an outsourced information security officer (vCISO).
[ 05 ] / WHAT IT SOLVES
The service removes uncertainty: you will know exactly whether the regulation applies to you, what you must do and in what order to proceed. The goal is a real security capability that both satisfies the legal expectation and reduces the risk of incidents.
For leadership, the support provides a basis for decisions and documented approvals. For the organization, it delivers a sustainable, auditable way of operating that also shows customers and partners you are serious.
[ 06 ] / WHY QYNTAR
Because NIS2 is a legal, executive and technical challenge all at once, and we bring all three kinds of knowledge.
Executive experience from a regulated sector: we know how to turn requirements into budgets, executive decisions and day-to-day operations.
We do not just write controls down, we verify them technically, because our team has attacker experience.
Our risk-based approach means we do not build an over-engineered, formal system. We focus on what really reduces risk in your organization.
We understand industrial and critical infrastructure environments, where IT and OT security are interlinked.
[ 07 ] / FAQ
NIS2 is the EU's cybersecurity directive (2022/2555), replacing the original NIS Directive. It covers more sectors and organizations and introduces more detailed risk management requirements, stricter reporting deadlines, management accountability and higher penalties.
Applicability depends mainly on sector (critical or important), organization size and the nature of the service. A precise answer requires looking at the sector classification and national legislation, which we help with through the applicability assessment. This is not legal advice.
For a significant incident you must send the competent authority an early warning within 24 hours, an incident notification within 72 hours and a final report within one month at the latest. Check the procedural details against Hungarian law. Our incident response service helps you prepare.
Under the directive, fines of up to 10 million euros or 2% of worldwide annual turnover for essential entities, and 7 million euros or 1.4% for important entities, whichever is higher, can be imposed. Always assess the Hungarian penalty regime against the legislation in force.
It is a good foundation but not automatically sufficient. NIS2 adds expectations (for example supply chain management, strict incident reporting and management accountability), so a gap analysis alongside ISO 27001 operation is worthwhile. See also compliance support.
It depends on your starting point and size. A gap analysis and action plan take a few weeks, while full implementation, from policies to technical measures, can take several months. We set priorities by regulatory deadlines and risk.
The regulation expects information security governance and a clear allocation of responsibility. If you do not have the expertise in-house, an outsourced arrangement is possible: see our vCISO service. Always check the precise legal requirements.
[ 08 ] / RELATED SERVICES
From a specific technical issue to a complex security project, we can help you find the way forward.