Cyber security for SMEs and scale-ups
Know what is exposed, fix it in order of risk, and hand your customers the evidence they ask for.
By sector: Manufacturing · Logistics and transport · IT and software · Healthcare · Professional services
NIS2 supplier-readiness assessment
10 working days · fixed scope · written deliverables
- External attack-surface report
- Email authentication
- Server and cloud hardening
- Web security headers
- The Dutch Cyberbeveiligingswet (Cbw), which implements NIS2, entered into force on 15 August 2026 with no general transition period. source
- NIS2 (Directive (EU) 2022/2555) had a transposition deadline of 17 October 2024; the Netherlands transposed it almost two years late. source
- The Dutch government estimates around 8,000 organisations fall within scope, many never regulated for cyber security before. source
- Board-level training must be in place by 15 August 2028; most other duties applied from day one. source
- Suppliers to in-scope companies are not regulated directly, but receive supplier questionnaires because supply-chain security is one of the NIS2 themes.
- In-scope entities must send an early warning of a significant incident within 24 hours and a full notification within 72 hours (Article 23). source
- Fines for essential entities reach EUR 10 million or 2% of worldwide annual turnover, and EUR 7 million or 1.4% for important entities (Article 34); management bodies are personally accountable for approving the measures (Article 20). source
You are probably here because
- A customer sent you a NIS2 or supplier-security questionnaire and the deadline is close.
- You host client data and cannot say, in writing, what is exposed to the internet.
- Someone impersonated your domain in an invoice email and it almost worked.
- An insurer, auditor or enterprise buyer asked for evidence, not assurances.
Deliverables, format, and when they land.
| Deliverable | Format | When |
|---|---|---|
| External attack-surface report | PDF, every exposed service listed with severity and fix | Day 3 |
| Email authentication | SPF, DKIM and DMARC moved to enforcement, with monitoring | Week 1 |
| Server and cloud hardening | Key-only access, firewall rules, patch state, rate limiting, backups | Week 1–2 |
| Web security headers | Content Security Policy, HSTS, framing and MIME protections, verified | Week 1 |
| Remediation plan | Ordered by risk, with owner and effort per item | Day 10 |
| Evidence pack | Mapped to NIS2 themes so you can answer the questionnaire line by line | Day 10 |
NIS2 supplier-readiness assessment
External reconnaissance, authenticated configuration review, email and domain authentication, cloud and hosting posture, and a staff phishing baseline. You receive a written report, a remediation plan ordered by risk, and an evidence pack mapped to the NIS2 themes your customer is asking about.
10 working days
We do not issue certifications and never claim compliance on your behalf. We give you evidence and a plan; the certification route, if you need one, is a separate decision.
Most clients keep us for the remediation sprint, then a quarterly re-check so the evidence stays current.
Ordering is a scoping call, not a cart. You receive the written scope before you commit.
Book the scoping callHow the work is done
Each step produces something written. If a step has no artefact, it did not happen.
- External reconnaissanceDNS, TLS, HTTP headers, exposed ports and services, leaked credentials, email authentication state. Nothing is touched; everything is recorded.
- Authenticated reviewServers, cloud consoles, admin panels, access control and MFA, backups and patching, reviewed with your credentials under a written scope.
- Email and domain authenticationSPF, DKIM and DMARC designed around how you actually send, then moved to enforcement without breaking delivery.
- Remediation sprintFixes applied in risk order, by us or with your team, each one re-tested before it is marked done.
- Evidence packFindings and fixes mapped to NIS2 themes: risk management, incident handling, supply chain, access control, encryption, training.
- Monitoring and re-checkOptional retainer: DMARC reports, certificate and exposure monitoring, quarterly re-assessment.
What the assessment gives you per NIS2 theme
We provide evidence and a remediation plan. We do not issue or promise certification.
| NIS2 theme | What you can hand over |
|---|---|
| Risk management | Attack-surface report, remediation plan |
| Incident handling | Incident contact, runbook, logging checks |
| Supply chain | Sub-processor list, supplier questionnaire answers |
| Access control | Key-only access, MFA, least-privilege review |
| Encryption | TLS configuration, data-at-rest and backup encryption |
| Training | Phishing baseline and a short staff briefing |
We run the same checks on ourselves. The results, gaps included, are on the security page, and our disclosure contact is published in security.txt.
Free external attack-surface check
Give us your domain. We check DNS, email authentication, TLS, security headers and exposed services, and send you a short PDF within one business day.
One request per company. We read every submission ourselves; nothing is automated beyond the checks themselves.
Asked before most engagements
Do we need to be NIS2 in scope to use this?
Will you certify us?
Is any of this disruptive?
Where are you based and who do we contract with?
What do you check on your own site?
Scope the NIS2 supplier-readiness assessment in a 30-minute call.
We reply within 12 hours on WhatsApp
