Directive (EU) 2022/2555
NIS2 and data protection
The NIS2 directive extended cybersecurity obligations to thousands of businesses. Backup, incident recovery and access protection are no longer optional. We help you get them right.
- Incident early warning
- 24 h
- Incident notification
- 72 h
- Maximum fine
- €10M
- Of global turnover
- 2 %
Who NIS2 applies to
In Slovakia, NIS2 is transposed into the Cybersecurity Act and supervised by the National Security Authority (NBÚ). Far more businesses are affected than under the previous rules.
Medium and large companies
Typically 50+ employees or annual turnover above €10M in a regulated sector.
Critical sectors
Energy, transport, banking, healthcare, water, digital infrastructure and ICT service management.
Other sectors
Manufacturing, food, chemicals, waste management, postal services and digital providers.
Suppliers
Even smaller companies supplying regulated entities. Customers require them to demonstrate security.
What NIS2 requires for your data
The directive sets minimum security measures. These directly concern your data and storage.
- Backup and disaster recovery
- Regular backups an attacker cannot delete, and a ready recovery procedure after an incident.
- Business continuity
- A plan to keep or quickly restore key services during an outage or attack.
- Incident reporting
- An early warning within 24 hours and an incident notification within 72 hours. Impossible without monitoring.
- Access control and MFA
- Multi-factor authentication and system access for authorized people only.
- Encryption
- Data protected in transit and at rest, including backups outside your building.
- Verifying effectiveness
- Measures must be tested regularly, and you must be able to prove it during an inspection.
What non-compliance costs
NIS2 brings stricter penalties and personal accountability for management.
High fines
Up to €10M or 2% of global turnover for essential entities, up to €7M or 1.4% for important entities.
Management accountability
Executives are responsible for approving and overseeing security measures.
Business downtime
The biggest loss isn't the fine - it's days without access to your data after an attack.
Are you ready? A quick test
If you can't answer any of these with a clear yes, your backup most likely doesn't meet NIS2 requirements.
- Do we have backups that not even an administrator can delete?
- Is at least one copy of our data outside our building?
- Are backups encrypted in transit and at rest?
- Is backup management protected by two-factor authentication?
- Do we know how long restoring the whole company would take?
- Have we run a real recovery test in the last 3 months?
- Would we detect an attack in time to report it within 24 hours?
- Do we have a written runbook we can present during an inspection?
Solutions ready for NIS2
The Backup package covers the core backup requirements and regularly verified recovery with a report for inspections. The Ransomware Guard add-on adds instant attack detection and backup protection.
How we help
We take care of the technical side of compliance - backup, recovery, access protection and monitoring - and provide the evidence to prove it.
- 01
Free audit
We map your current backup setup and compare it with NIS2 requirements.
- 02
Solution design
We design an architecture with WORM backups following the 3-2-1-1-0 rule.
- 03
Deployment
We deliver Synology storage and set up backups, encryption and MFA.
- 04
Recovery tests
We verify recovery quarterly and provide a report as evidence for inspections.
- 05
24/7 monitoring
We watch your storage and backups so incidents are caught early.
NIS2 FAQ
How do I know if NIS2 applies to my business?
It depends on your sector and company size (typically 50+ employees or turnover above €10M). Some entities are regulated regardless of size. Our free audit helps you get oriented; we recommend confirming the binding assessment with a lawyer or directly with the NBÚ.
Does NIS2 affect smaller companies?
Usually not directly, but often indirectly. Regulated companies must check the security of their suppliers, so they require it from smaller partners too.
Is a good backup enough for NIS2?
No. NIS2 requires a full set of measures, including risk management, incident reporting and training. Backup, recovery and access protection are, however, its key technical part - and we handle that for you.
How do I prove my backups work?
With regular recovery tests. In the Backup package we verify recovery quarterly and you receive a report you can present during an inspection.
Are you NIS2 legal advisors?
No. We handle the technical side - storage, backup, recovery and monitoring. For the legal assessment we are happy to work with your lawyer or security manager.
Find out where you stand with NIS2
In a free audit we review your backups and recommend what needs to be added.
Contact us