IT security for small and mid-sized firms: endpoints, backup, NIS2 readiness
For small and mid-sized firms, IT security mostly comes down to a few basics: protected endpoints, backups that actually restore, and knowing who can access what. We can put these in place and keep them maintained, and help you prepare if a larger customer expects NIS2-aligned measures from you as a supplier.
Endpoint protection with ESET
As an ESET partner we supply and centrally manage endpoint protection, so you can see which machines are up to date and where a threat was detected. Alerts are handled through our monitoring and appear in the monthly report.
Backup and test restores
We suggest the 3-2-1 rule: three copies, on two different media, one of them off site. A backup is only as good as the restore, so we check backup status in operations and schedule and document test restores as agreed in the operations contract.
Access management and leavers
The access register records who can reach what and how; it is one of the IT audit deliverables. When someone leaves, we follow a fixed sequence so no account or share stays active.
- Disable the account and revoke passwords and sessions.
- Hand over the mailbox and files to the designated colleague.
- Remove shares, remote access and permissions in business applications.
- Collect devices and update the access register.
NIS2 readiness for suppliers
NIS2 applies directly mainly to organisations in listed sectors above 50 staff or EUR 10 million turnover, so many small and mid-sized firms are not in scope themselves. As suppliers, however, they may be affected, because customers in scope can set IT security requirements for them.
Here we offer preparation: we assess the gaps against a customer's questionnaire and give recommendations; implementation is quoted separately. Preparation covers technical and organisational recommendations; certification and legal advice are outside its scope. In Hungary, audits of in-scope organisations are carried out by auditors registered with the SZTFH.
External exposure check
The IT audit includes an external scan showing which ports and services are reachable from the internet, and the state of certificates and DNS. We use Nmap and Greenbone Community Edition, at a time agreed in advance.
We suggest starting a security review with the audit
The IT audit gives a written view across eight areas, including backup, endpoints and external exposure, from HUF 149,000 + VAT.