European cybersecurity rules
now reach small businesses
The NIS2 Directive (EU) 2022/2555 sets mandatory cybersecurity measures for organisations across the EU. Even if your company is not directly in scope, your customers may be, and they will ask how you protect their data.
An honest note: there is no official “NIS2 certificate”, and compliance stays your company’s responsibility. What we do is put the technical measures in place, operate them every day and give you monthly evidence for auditors, insurers and customers.
Who is in scope
Medium and large organisations (50+ employees or €10M+ turnover) in 18 sectors, including manufacturing, transport, health, digital infrastructure and managed IT services.
Suppliers too
In-scope companies must assess the security of their suppliers (Art. 21(2)(d)). Small businesses that supply them increasingly receive security requirements by contract.
Incident reporting
Early warning within 24 hours, incident notification within 72 hours, final report within one month.
Management accountability
Management bodies must approve cybersecurity measures, oversee them and complete training (Art. 20).
Fines
Up to €10M or 2% of global turnover for essential entities, €7M or 1.4% for important entities.
GDPR applies to everyone
Article 32 GDPR requires appropriate technical and organisational security for personal data, whatever your size.
NIS2 Article 21 measures
and how we cover them
| NIS2 measure | Article | How Plaren covers it |
|---|---|---|
| Incident handling | 21(2)(b) | Tickets and escalation in ServiceDesk Plus, device isolation, incident forensics in next-gen antivirus. |
| Backup & recovery | 21(2)(c) | Ransomware rollback from shadow copies; Microsoft 365 and Azure backup recommendations. |
| Vulnerability handling | 21(2)(e) | Vulnerability Management and patching of operating systems and 850+ applications. |
| Effectiveness assessment | 21(2)(f) | Monthly compliance reports, Secure Score tracking and quarterly reviews. |
| Cyber hygiene & training | 21(2)(g) | Plaren Baseline, browser security, application control and user guidelines. |
| Encryption | 21(2)(h) | BitLocker and FileVault with centrally managed recovery keys. |
| Access control & assets | 21(2)(i) | Conditional Access, least privilege, full hardware and software inventory. |
| Multi-factor authentication | 21(2)(j) | MFA for every user and admin, legacy authentication blocked. |
Organisational measures such as risk policies (21(2)(a)) and supply-chain assessment (21(2)(d)) remain with your management. We provide the technical input and documentation.
Every client gets the same
proven baseline
40+ security and management controls applied from day one, monitored continuously and reported monthly. No guesswork, no “it depends on the engineer”.
Identity
- MFA for 100% of users
- Conditional Access policies
- Legacy authentication blocked
- Separate admin & break-glass accounts
Devices
- Entra Join or Hybrid Join
- BitLocker on every laptop
- LAPS for local admin
- No local admin rights for users
Updates
- Critical patches within 72 hours
- All patches within 14 days
- Third-party apps automatically
- Vulnerability scanning
Protection
- Next-gen antivirus
- Ransomware rollback
- Browser security
- Application control
- SPF, DKIM, DMARC
- Anti-phishing policies
- No auto-forwarding outside
- Mailbox auditing
Process
- Onboarding / offboarding checklists
- Monthly report
- Quarterly access review
- Documented environment
Your devices talk only to our private, EU-hosted platform.
Endpoint Central MSP and ServiceDesk Plus MSP run on dedicated servers in an EU data center (Germany). The platform is not open to the internet: only enrolled client devices and Plaren engineers can reach it.
Firewall allow-listing
The platform is not open to the internet. Only enrolled client devices and Plaren engineers can connect.
Encrypted agent channel
Agents connect outbound over HTTPS/TLS. No inbound ports on your network.
Console behind VPN + MFA
The admin console is reachable only by Plaren engineers through VPN with multi-factor authentication.
Strict tenant isolation
Each client is a separate customer in the platform. Data never mixes.
Full audit trail
Every remote session and configuration change is logged.
EU data residency
Inventory and ticket data are stored in an EU data center (GDPR).