Discussions about NIS2 and Hungary’s cybersecurity requirements often focus on solutions that make perfect sense in a large enterprise but are too complex, too expensive or simply disproportionate for a small municipality, institution or business with five to ten employees.
At CyberTeam Kft., we regularly encounter organizations like these in our day-to-day work. They have no dedicated information security department, no sizeable IT team and no budget for expensive security platforms. They may have a few workstations, a NAS, a router, some cloud services and perhaps an outsourced system administrator – yet they still need to meet legal and information security requirements.
That is what inspired our new expert series:
NIS2 for Smaller Organizations
My name is Vass Gergely Zoltán. I am an information security specialist and the professional lead at CyberTeam Kft. In this series, I will explore the 19 families of requirements set out in Hungary’s Decree 7/2024 (VI. 24.) MK, specifically from the perspective of smaller organizations.
Our aim is not to show how to install an enterprise-scale security infrastructure in a small organization.
Quite the opposite.
For each family of requirements, we will examine:
- what the regulation actually requires;
- the minimum a small organization genuinely needs to implement;
- which requirements can be met through suitable organizational processes and configuration;
- where simple, free or open-source solutions can be used;
- what documentation is needed;
- and what evidence can demonstrate implementation during an inspection or audit.
The goal is not to buy another piece of software for every requirement.
In many cases, configuring an existing system correctly, maintaining a straightforward register, establishing a sound process and documenting it consistently provide more value than expensive technology the organization cannot realistically operate.
More than just an article series
“NIS2 for Smaller Organizations” is also a community initiative.
We want to involve system administrators, information security officers, auditors, IT professionals and organizational leaders who have already found straightforward, effective ways to meet particular requirements in practice.
If you know of a method, tool or approach that has proved useful in a smaller organization, we welcome your comments and professional feedback.
We are particularly interested in solutions that:
- are easy to operate and maintain;
- do not entail substantial licence fees;
- are practical in a small IT environment;
- and provide clear, verifiable evidence of compliance during an audit.
We hope to incorporate useful experience and good practices shared by the community into future installments.
Our goal: a practical guide built together
Once we have covered all 19 families of requirements, we intend to bring together the series and the community’s contributions in a practical professional publication:
“NIS2 for Smaller Organizations – A Practical Guide”
We envisage a guide that does more than list requirements. It should also explain:
What needs to be done? How can it be implemented simply? Which tools can help? And how can an organization demonstrate that the measures actually work?
Part one: Program Management
We will begin with the first family of requirements in Hungary’s Decree 7/2024 MK: Program Management.
This opening topic will already demonstrate the central principle of the series.
A small organization does not necessarily need twenty separate policies and a dedicated governance, risk and compliance (GRC) system simply because a family of requirements contains numerous mandatory elements.
We will show how to bring those elements together in a transparent, straightforward and manageable framework – for example, with a well-designed information security policy (IBSZ), registers of electronic information systems (EIR) and risks, an action plan, an annual review plan and regular management reports.
We are not looking for ways around the requirements.
We are looking for ways to meet them proportionately, sustainably and in a manner that stands up to an audit.
This is the approach CyberTeam Kft. follows in its daily work: first we understand how an organization actually operates and what risks it faces, and then we choose the measures that fit.
A good information security solution is not good because it is complicated.
It is good because it actually works.