NIS2 preparation and vCISO

NIS2 is the EU cybersecurity directive that requires many companies and institutions to protect their IT systems in an organised way. A vCISO is an external chief information security officer: full expertise, without a full-time hire.

Who is it for?

  • Medium and large companies in sectors covered by NIS2, such as manufacturing, transport, courier services, water or energy.
  • State and municipal organisations subject to specific cybersecurity rules.
  • Suppliers whose NIS2-regulated customers ask them to prove their security.
  • Companies that need a responsible expert but cannot justify a full-time security leader.

NIS2 in a nutshell

In Hungary, NIS2 is implemented by Act LXIX of 2024, and supervised by the Supervisory Authority of Regulatory Affairs (SZTFH). Covered organisations must, among other things, register, assess their risks, put protective measures in place, report significant incidents and undergo regular cybersecurity audits.

Responsibility does not sit with IT alone: senior management must understand and oversee cybersecurity too. Exactly what applies depends on the organisation’s activity and size, so that is where we always start.

What does a vCISO do?

Think of an outsourced finance director, but for security. A vCISO knows what the law expects, ranks what needs doing, gets the required documents in place and reports to management in plain language. We can also take on the role of the person responsible for the security of electronic information systems.

Staff training belongs here too. People are often the weakest point, so we support security awareness with regular training and easy-to-read newsletters.

How we work

  1. Assessment

    We check whether you are covered, what your duties are and where you stand today.

  2. Risk analysis

    We work out what threatens your systems and how much damage each threat could do.

  3. Action plan

    You get a prioritised plan with owners and deadlines.

  4. Implementation

    We build policies, processes and supplier requirements, and train your people.

  5. Audit preparation

    We organise the evidence and walk through what the auditor is likely to ask.

  6. Ongoing operation

    As your vCISO we keep watching risks, incidents and necessary updates.

What you receive

  • A tailored action plan
  • A risk register
  • Policies and procedures
  • Supplier compliance documents
  • Staff training and security newsletters
  • Regular management reports in plain language

Frequently asked questions

How do I know if NIS2 applies to my company?

Your activity and size decide. Organisations in the listed sectors are typically covered from medium size upwards, and some regardless of size. After a short assessment we can tell you where you stand.

Does Quentit carry out the NIS2 audit?

The statutory cybersecurity audit is done by an independent, authorised auditor. We prepare you to pass it and help with fixes based on the findings.

What is the difference between a CISO and a vCISO?

The job is similar. A CISO is a full-time employee; a vCISO is an external expert you use as your actual needs require.

How long does preparation take?

It depends on your size and starting point. We give a realistic schedule after the assessment.

References

  • ExpressOne Kft.
  • ASP Hungary Kft.
  • Tobroco Kft.
  • Heves Megyei Vízmű Zrt.
  • Egri Tankerületi Központ