NIS2 for groups and multinationals: which Member State supervises each entity
If your group has entities in several EU countries and a customer, contract or regulator has set a deadline, the first question is which national authority supervises each entity. Under Article 26 of NIS2, most entities fall under the Member State where they are established. Certain digital infrastructure and digital provider entities, such as cloud, data center, CDN, managed service and online platform providers, follow the main establishment rule instead, so one Member State supervises them for the whole Union. Map each legal entity to its sector and category before you assume a single answer applies to the group.
The answer then changes with four things: entity type, whether an entity has an EU establishment at all, its Annex I or II sector, and the transposition law of each Member State. Main establishment is decided by where cybersecurity risk-management decisions are predominantly taken, then where cybersecurity operations are carried out, then the EU establishment with the most employees. Groups often find that these decisions sit in one country even when the staff work elsewhere, so record where they are actually taken. Non-EU providers in the Article 26(1)(b) categories must designate a representative in a Member State where they offer services. Ask your national authorities and counsel to confirm how their transposition laws treat your entity types, since the Directive sets a baseline that Member States may exceed (Article 5).
Your organization owns its controls, registrations and the decisions described above. An implementation partner can prepare systems, configurations, logs and evidence for each supervising authority, but it does not register entities or sign attestations for you. Only an independent auditor, assessor or certification body issues reports or certificates, and NIS2 itself creates no certificate of compliance. Before you engage anyone, confirm in writing which authority supervises each entity, which registration portal applies, and which evidence that authority expects, because the answers drive the scope of the work.
Which jurisdiction rule applies to each type of group entity
Most in-scope entities fall under the Member State where they are established. Article 26(1) makes establishment the default anchor, so jurisdiction is decided entity by entity. A parent in one country and a service subsidiary in another therefore produce two separate answers, and the subsidiary's obligations are generally shaped by the national law where it is established. Because NIS2 is a directive, the detail comes from that country's transposing law, which may set a higher level of cybersecurity than the Directive requires. See Article 26 of Directive (EU) 2022/2555.
- Legal entity test: Classify each in-scope legal entity separately, including holding companies and subsidiaries that deliver regulated services.
- Establishment facts: Record the registered seat and the place of actual operations for every entity, since these facts anchor jurisdiction.
- National rules: Confirm the registration portal, competent authority and fine ceiling in each Member State where an entity is established.
- Illustrative example: A holding company established in Country A owns a logistics service subsidiary established in Country B. If the subsidiary is in scope, it generally answers to Country B's authority under Country B's law, while the holding company is assessed on its own establishment.
Confirm the registered seat, sector and subsector of each entity, and whether any national law names a different authority for it.
Electronic communications providers follow a service-based anchor. Article 26(1) places them under the Member State where they provide services, so the registered seat matters less than the countries where customers receive the service. For a group, this means the answer can change with each service line and each market served, even when the legal entity stays the same.
- Service footprint: List every Member State where the entity provides services, since that list determines which regimes may apply.
- Registration detail: Under Article 3(4), the entity must tell the competent authority which Member States it serves as part of its registration details.
- Group networks: Where several subsidiaries deliver network services, assess each subsidiary's footprint on its own service delivery.
- Illustrative example: A telecom group whose operator subsidiary in Country A provides fixed broadband in Country A and Country C would generally fall under the transposing laws of both countries for that service, so the group must check both.
Confirm which subsidiary delivers which service in which country, and keep that service map current as offerings change.
Public administration entities are assigned to the Member State that established them, under Article 26(1). The test looks only at the founding state, so the location of services, offices or staff does not change the answer. For a group, this matters mainly where the structure includes state-created or state-owned bodies, since the founding act decides which country's regime applies.
- Founding act: Identify the law, decree or instrument that created each body, since it shows which Member State established it.
- Multi-state arrangements: Where a body was set up under arrangements involving more than one state, confirm with each national authority which one treats it as its own.
- Scope of the sector: Whether a given public body is in scope depends on national law, so check the national definition of public administration.
- Illustrative example: A regional development agency established under the law of one region of Country A, with offices in Country B, would generally fall under Country A's regime because Country A established it.
Ask the competent authority of the founding state to confirm the scope decision in writing before building the program around it.
Listed digital infrastructure and digital provider types follow the main establishment test in Article 26(1)(b). This covers DNS service providers, TLD registries, domain registration services, cloud, data center, CDN, managed and managed security service providers, online marketplaces, search engines and social networks. Where such an entity has several EU establishments, Article 26(2) asks first where cybersecurity risk-management decisions are predominantly taken, then where cybersecurity operations are carried out, and finally which EU establishment has the most employees. Implementing Regulation (EU) 2024/2690 applies directly in all Member States, so its technical requirements do not vary by country, but jurisdiction for these entities still follows the main establishment.
- Decision test first: Document where cybersecurity risk-management decisions are predominantly taken, using records such as board minutes and approval logs.
- Operations second: If decisions do not settle the answer, check where cybersecurity operations run, such as security operations centers.
- Headcount last: Use employee numbers per EU establishment only as the final fallback.
- Non-EU providers: A listed provider without an EU establishment that offers services in the Union must designate a representative in a Member State where it offers services, under Article 26(3).
- Illustrative example: A cloud provider group with security decisions taken in Country A, security operations in Country B and most staff in Country C would generally have its main establishment in Country A, because the first test points there.
Confirm which test your entity meets, and keep the decision records that support it, since a change in governance could move the answer.
How the SME size test applies to subsidiaries of a larger group
A subsidiary's NIS2 size status is not decided by its own headcount alone. The size test looks at how the entity relates to partner and linked enterprises, and national authorities apply that test with some discretion. The cards below set out the components to document and the questions to put to national authorities or counsel.
Headcount and financial thresholds
The SME test uses headcount and either annual turnover or balance sheet total, with thresholds set in Commission Recommendation 2003/361/EC. For a group subsidiary, the starting point is the entity's own figures, which then must be adjusted for partner and linked enterprises. Confirm the current thresholds against the text of the Recommendation before any decision, because the figures in older commentary may be outdated. Keep the dated extract you relied on in the file.
Partner and linked enterprise data
Under the SME definition, figures are aggregated across linked enterprises (controlled entities and their controllers) and partner enterprises (minority or cross-holdings) in proportion to the ownership stake. A subsidiary that looks small on its own can be large once parent and sister companies are counted. Collect the ownership chain and the consolidated figures for every entity that feeds into the calculation, and state the reporting period used.
Independence in systems and services
Recital 16 of NIS2 allows Member States to consider an entity's independence from partner or linked enterprises in its systems and services when applying the SME calculation. A subsidiary that runs its own identity, network and cloud tenancy may argue for a different treatment from one that depends on group IT. Whether this argument is accepted depends on the national authority, so ask in writing how it will be weighed and which evidence it expects.
Documenting the group relationship
Whatever position the group takes, the file should show how the entity relates to the group: ownership, board control, shared services, shared security operations and who takes cybersecurity risk decisions. These facts also feed the main establishment analysis, so the same documents serve both questions. Keep them current, because a change in ownership or shared services can change the size outcome.
National discretion in applying the test
NIS2 is a directive, so each Member State's transposition law decides how the size test is applied, how the authority registers entities and what evidence it accepts. Two subsidiaries in different countries with the same facts can receive different answers. Ask the national competent authority for its written guidance, its registration rules and any published position on group entities, and record the date and reference of each answer.
What to request from authorities or counsel
Request a written decision or guidance on the size outcome, the thresholds and reference period applied, how linked and partner enterprises were counted, and whether independence is considered. Counsel should review the ownership data and national law together. Confirm the proposed COM(2026) 13 amendments separately, since they are a proposal and may change size categories if adopted.
Registering in several Member States without duplicating the program
Article 3(4) of NIS2 requires an entity to give its competent authority a defined set of identifying details: its name, address and contact details, including email addresses, IP ranges and telephone numbers, its Annex I or II sector and subsector, and the Member States where it provides services. For a group, the same facts appear in every national filing, so the first decision is to hold one group-level register of entities, legal names, addresses, IP ranges and sector classifications, from which each national submission is drawn. Keep the register under the control of the group's compliance or security function, and assign a named owner to update it when a subsidiary is created, sold or changes its services.
The registration portals, deadlines, forms and fields are not set by NIS2 itself. They come from national transposition laws, which is why they differ by country. Transposition has also been uneven. The Commission called on 23 Member States to complete transposition in its 28 November 2024 news item and on 19 Member States in its 7 May 2025 item, and on 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules. A group should therefore check, for each country where it provides services, whether the national law is in force, which authority receives registrations, and what the current deadline is. Confirm each portal and deadline directly with the relevant authority, because a secondary summary can be out of date.
The efficient approach is a single group-level evidence set mapped to each national registration. Build one file per entity that holds the Article 3(4) data, the sector evidence, the list of service-delivery countries and the named contacts, then record for each country the portal used, the submission date, the reference number returned and the person who submitted. This avoids re-deriving facts for every filing and keeps the answers consistent across regulators, which matters when a supervisor compares them. Ask the organization's counsel to confirm which national filing applies to each entity, since the answer depends on the jurisdiction rules discussed elsewhere on this page.
How a group maps its entities to supervisors, step by step
This sequence turns a group's legal structure into a documented record of which entities NIS2 covers, which Member State and authority oversees each one, and what each country requires them to register. The group owns every decision and keeps the record that supports it.
Build the legal entity inventory
List every legal entity in the group, including holding companies, service companies and branches, and record each EU establishment with its registered address, the countries where it operates and the entities it controls or is controlled by. An external adviser may compile this list from corporate registers and org charts, but the group's legal and company secretarial teams confirm it. The step closes when the group signs off a single inventory that every later step uses.
Classify each entity by sector and size
For each entity, record the Annex I or Annex II sector and subsector that matches its activities, using the sector definitions in the Directive. Then apply the size test to each entity on its own figures, and note where the group's ownership and shared systems could affect the calculation, since Recital 16 allows Member States to consider an entity's independence from partner or linked enterprises. The output is a classification table with the reasoning written beside each row, approved by the group's compliance owner.
Identify listed provider types and their main establishment
Flag every entity that falls under a provider type listed in Article 26(1)(b), such as DNS, TLD, cloud, data center, CDN, managed or managed security service providers, online marketplaces, search engines or social networks. For each flagged entity, apply the Article 26(2) order: first the EU establishment where cybersecurity risk-management decisions are predominantly taken, then where cybersecurity operations are carried out, and finally the EU establishment with the most employees. The group's management decides which establishment applies and records the evidence behind that decision.
Determine the applicable national law and authority
For each entity, decide which Member State's transposition law governs it, using the establishment rule in Article 26(1) for general entities and the main establishment result for listed provider types. Then record the competent authority named in that country's law and the sector rules that may displace NIS2 for particular activities. Because transposition is still uneven across the Union, check the current national law for each jurisdiction rather than relying on the Directive text alone. The output is one row per entity naming its Member State, authority and governing law.
Record registration obligations for each country
For every entity and every Member State where it offers services, list the information the authority requires, which under Article 3(4) includes name, address, contact details including email addresses, IP ranges and telephone numbers, sector and subsector, and the Member States where services are provided. Note the registration portal, the format and any deadline set by national law, confirming each with the authority. Entities listed under Article 26(1)(b) that are not established in the Union must also record whether a representative is required. The output is a registration register that shows what is filed, where and by whom.
Assign owners for national contacts
Name one accountable owner for each Member State and each entity who will receive authority correspondence, answer information requests and keep contact details current. Where a local representative or legal counsel acts for the group, put the delegation in writing and state what that person may and may not decide. The step closes when the register lists a named owner and a backup for every contact point, and management has approved the ownership model.
Approve and review the supervisory map
Present the completed inventory, classifications, jurisdiction decisions and registration register to the management body for approval, recording the rationale for any judgment call. Set a review trigger for changes such as acquisitions, new service countries, reorganizations or amendments to national law, including the proposed NIS2 amendments that the Commission published in January 2026 and that remain under negotiation. The signed-off map is the document a supervisor will ask to see first.
Group-wide program or country-by-country program: which fits
This table compares three structuring options a corporate group can use for NIS2, with when each fits, the internal effort it asks for and its main risk. Read it as a starting point for an organizational decision, then check each option against the transposition law of every Member State where the group has in-scope entities.
| Option | When it fits | Internal effort (general terms) | Main risk |
|---|---|---|---|
| Group-wide control set with national overlays | Subsidiaries share IT platforms, identity, hosting and security tooling, and national rules differ mainly in registration and reporting details | Front-loaded effort to build one control set and evidence library, then recurring effort to maintain national overlays for registration, portals and reporting | Overlays drift out of date when a Member State changes its transposition law, and a control set written too generally may not satisfy a local supervisor |
| Lead-entity model for listed provider types | Cloud, data center, managed service or other Article 26(1)(b) providers whose main establishment is the same entity for group-wide cybersecurity decisions | Concentrated effort in the lead entity to document risk-management decisions for the group, with smaller effort in other entities to show they follow those decisions | The lead entity's main establishment finding is challenged if decisions are actually taken in another country, and the documentation does not match day-to-day practice |
| Separate country programs | Entities operate under materially different national laws, supervisors or sector rules, or local management needs its own accountable program | Highest recurring effort, because each country needs its own policies, governance records, evidence and reporting contacts | Inconsistent controls and evidence across countries, and duplicated tooling and staff time that raises cost over time |
What the January 2026 NIS2 proposal could change for groups
On 20 January 2026 the European Commission proposed targeted amendments to NIS2 (COM(2026) 13). For groups, the two parts that matter most are the proposed simplification of the jurisdictional rules and the new small mid-cap category. The proposal still has to pass through the European Parliament and the Council before it becomes law, and Commission pages updated through July 2026 continue to describe it as a proposal. Until it is adopted and transposed, your obligations come from the Directive as transposed in each Member State, and from Implementing Regulation (EU) 2024/2690 for the entities it covers.
Plan against the law in force. Map each group entity to its current Member State of jurisdiction under Article 26, confirm which national registration portal and competent authority apply, and build the Article 21 measures to the strictest national requirement you face. Do not restructure a group, move a security function or delay registration on the assumption that the proposal will change the answer. Ask your national authority or legal counsel which transposition law governs each entity today, and record the answer with its date.
Track the proposal as a formal assumption register. For each planning decision that depends on the amendments, such as which entity becomes the main establishment for cloud or managed services, or whether an entity falls under the small mid-cap category, write down the assumption, the owner, the source you checked and the trigger that would require a review. Review the register when the Parliament or the Council publishes a position and again when the text is adopted. Keep the register with your NIS2 governance records so a supervisor can see how you handled regulatory uncertainty.
Who does what: group management, local teams, implementation partner and auditor
Under Article 20, the management body of each in-scope entity must approve the Article 21 risk-management measures, oversee how they are implemented, and complete cybersecurity training. In a group, the open question is which board approves for which legal entity. A group board can set a common framework, but each in-scope subsidiary's own management body still needs to approve the measures that apply to that subsidiary. The group board also decides where cybersecurity risk management is predominantly taken, which matters for the main establishment rule in Article 26(2).
- Approval per entity: each in-scope legal entity's management body approves its measures, even when the group issues a shared policy set.
- Decision location: record where cybersecurity risk decisions are made, because that location can determine the Member State with jurisdiction under Article 26.
- Oversight: the board receives regular reports on measure status, open risks and significant incidents.
- Training: each member completes the mandatory training, and records are kept for each person.
- Personal exposure: Article 20 allows liability for infringements, and the detail depends on national transposition law.
Confirm which board signs each approval, where the minutes record those decisions, and how training evidence is kept for every member.
Local leads handle what national law requires of each entity: registration with the competent authority, incident notifications and the local records that support them. The details of registration and reporting come from national transposition laws, so a lead in one country may face different portals, languages and authorities than a lead in another. Article 3(4) sets the minimum information each entity must give its authority, including contact details, sector and subsector, and the Member States where it provides services.
- Registration data: supply name, address, contact details including email addresses, IP ranges and telephone numbers, sector, subsector and service Member States.
- Reporting path: hold the contact route to the national authority and the early warning, notification and final report deadlines in Article 23.
- Local law: identify the transposition law, competent authority and fine ceilings in each country where the entity is established.
- Local records: keep copies of registrations, notices and authority correspondence for each entity.
- Named contacts: nominate a person for the authority and an on-call contact for incidents.
Confirm each country's registration portal, deadlines and language requirements with the national authority, since these are set in national law.
An implementation partner such as DeployOpen prepares systems, documentation and evidence that the organization then reviews and adopts. Work runs under a written, fixed scope that names the legal entities, deliverables and timelines before it begins. The partner builds and documents the technical side of the measures inside the client's own cloud accounts, data centers or air-gapped networks. The partner does not approve measures, accept residual risk, register entities or issue any report or certificate.
- Systems: configure self-hosted platforms for logging, multi-factor authentication, backups and access control in the client's infrastructure.
- Draft documents: prepare policy drafts, procedures and control mappings for management and local lead review.
- Evidence collection: set up collection so logs, configurations, test results and review records can be produced on request.
- Testing support: run security testing and exercises, with results delivered to the organization that owns the findings.
- Handover: document configurations and runbooks so the client's own staff can operate and evidence the controls after delivery.
Ask for a written scope that names each entity, each deliverable, who signs off each artifact, and which tasks stay with the client.
NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines, as set out in Articles 32 to 34. Essential entities are supervised ex ante, and important entities ex post. An independent auditor or assessor can test the controls and report to the party that commissioned the work, but that report is an assessment, and no NIS2 certificate results from it. Any offer of a NIS2 certificate should be questioned closely.
- Authority role: the competent authority reviews compliance after inspection or audit and can order measures and impose fines.
- Supervision timing: essential entities face supervision before problems surface, while important entities are usually reviewed afterward.
- Assessor scope: an external assessor reports on the controls it tests and gives its findings to the client.
- Certificate offers: ask which standard is attested, who issues the document, and what it covers.
- Independence: the assessor should not design or implement the controls it tests.
Check which supervisor applies in each Member State and what evidence that authority has requested in past inspections.
What usually delays multinational NIS2 programs and how to avoid it
Multinational NIS2 programs rarely stall on the Directive itself. They stall on jurisdiction, registration, group-level assumptions and evidence that nobody has assigned. Each card below names one pitfall, the control step that prevents it and the role that should confirm it before work runs ahead of the facts.
Assuming one national law fits every subsidiary
NIS2 is a directive, so obligations, competent authorities, registration portals and fine ceilings come from each national transposition law, and those laws may set a higher level than the Directive. A group that applies one country's rules to all subsidiaries will miss local deadlines and local supervisors. Keep a per-country register of the applicable law, authority and portal for each entity, and have local counsel confirm it against the current transposition status.
Missing the main establishment question
Cloud, data center, CDN, managed service, DNS, TLD, online marketplace, search engine and social network providers fall under the Member State of their main establishment, not wherever they have customers. The main establishment is where cybersecurity risk-management decisions are predominantly taken, then where operations run, then the EU establishment with the most employees. Document where those decisions are made for each legal entity, and have the group legal lead confirm the answer in writing before registration.
Leaving registration for later
Entities must give their competent authority a name, address, contact details including email addresses, IP ranges and telephone numbers, their Annex I or II sector and subsector, and the Member States where they provide services. Each country may run its own portal and deadline, and a subsidiary can be in scope even when the parent is not. Build a single entity inventory with these data points early, then assign the compliance lead to file in each jurisdiction and keep the filings on record.
Treating a group policy as proof everywhere
A single group information security policy helps consistency, but a supervisor in each country will ask whether the controls operate for the entities it oversees. Map each Article 21 measure to the group policy, the local procedure and the local evidence, and record which entity owns each control. The group CISO should confirm that local management bodies have approved the measures, since approval and training duties under NIS2 sit with each entity's management body.
Underestimating supplier and evidence workload
Shared group platforms such as identity, logging, backup and vulnerability tooling can serve many entities, which makes evidence collection look simpler than it is. Each entity still needs its own records of logs, backup tests, access reviews and incident contacts, and each shared service provider needs contractual terms that allow the entity to meet its obligations. Assign an evidence owner per entity, agree the evidence schedule with the platform team, and confirm supplier clauses with legal before the first supervisory request arrives.
Building on the January 2026 proposal
The Commission proposed targeted NIS2 amendments on 20 January 2026 (COM(2026) 13), including simplified jurisdictional rules and a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, so it is not current law. Design the program against the Directive and national laws in force, then review the proposal at each governance cycle and record the decision to adjust or hold. The group regulatory lead should own that review.
Questions groups ask before they hire outside help
Which country supervises a subsidiary of a group that operates across the EU?
Usually the Member State where the subsidiary is established, because NIS2 generally ties jurisdiction to establishment. The exception is the list of digital providers such as cloud, data center, CDN, managed service and online platform providers, which fall under the Member State of their main establishment in the Union. The drivers are where the entity is incorporated or operates, where its cybersecurity risk decisions are taken, and which sector annex applies. Check Article 26 of the Directive, then confirm with the national competent authority, because concrete duties and registration portals come from national transposition laws, and transposition is not uniform across Member States.
What changes for a non-EU parent company under NIS2?
A non-EU provider in the digital categories listed in Article 26 that offers services in the Union but is not established there must designate a representative in a Member State where it offers services. Without one, any Member State where it provides services may take legal action. Other non-EU groups usually depend on whether they have an EU establishment and where their risk and operations decisions are made. Ask counsel to map each service to its Member State, confirm the representative designation rule in each national law, and record who holds the representative role and how that person is reached by authorities.
Can the SME size test exclude a subsidiary of a large group?
Not automatically. The SME definition in Commission Recommendation 2003/361/EC looks at headcount, turnover and balance sheet, and group links matter. Recital 16 of NIS2 allows Member States to consider how independent an entity is from partner or linked enterprises in its systems and services when applying the size calculation. How much weight that carries depends on each national law. Document the ownership chain, shared IT, shared security operations and shared suppliers, then ask the national authority how it applies the linked-enterprise test before relying on any exclusion.
How long do registration and the compliance program take?
Timelines depend on national registration portals and on the state of your existing controls. The Directive required Member States to transpose it by 17 October 2024 and apply national measures from 18 October 2024, but several Member States were still behind in 2025 and 2026, and the Commission has referred four to the Court of Justice. Confirm with each authority its registration deadline and whether it has a portal open, and ask it how it expects entities to report changes. For the program, the duration is driven by scope complexity, the number of entities, existing policy maturity and how many suppliers must be reviewed. No duration is given here because none was supplied as a researched fact.
What does the work need from the group's own staff?
Management and the group's legal, IT and security owners must make the decisions that NIS2 assigns to the management body, including approving the Article 21 measures and accepting residual risk. Operational staff must provide asset inventories, network diagrams, access lists, backup records, logs and supplier contracts. A named coordinator per entity, who can answer for each country's requirements, is usually the difference between a smooth engagement and one that stalls. Ask any partner to list these inputs in the written scope so that the group can plan internal time before work starts.
Can one implementation partner cover several countries?
A partner can prepare technical systems, policies and evidence across several countries, but it cannot replace the local legal analysis or the authority contact that each entity must maintain. The partner's role is to build controls that meet the technical requirements in the directly applicable Implementing Regulation (EU) 2024/2690 where it applies, and to package evidence that each national authority can review. Ask for a written scope that separates group-wide work from country-specific tasks, names which entities and Member States are covered, and states who handles national registration and legal interpretation. DeployOpen plans, implements and documents self-hosted open-source platforms in the client's own infrastructure, but it does not issue audit reports or certifications, and any supervisory assessment remains the authority's decision.
How DeployOpen works on this
DeployOpen is a Chainscore Labs company that plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure. For groups operating in several Member States, the work starts by agreeing in writing which entities, jurisdictions and systems are in scope, then prepares the controls and evidence each competent authority may ask to see. DeployOpen does not issue reports or certificates; independent auditors and the authorities themselves make those determinations.
How we scope
- Written scope lists each group entity, its sector, and the Member States where it provides services.
- We map which entities have their main establishment in a single Member State under Article 26 and which fall under national rules.
- Scope records the systems, cloud accounts and suppliers each entity relies on, so evidence can be assigned to the right owner.
How we build
- We implement self-hosted open-source tooling for logging, access control, backups and vulnerability handling inside the client's accounts or data centers.
- Configurations are documented per entity, so a shared platform can show what applies to each subsidiary and where it differs.
- Where national laws add requirements, we record the local variation in the control design rather than assuming one rule set fits all.
How we hand over
- Each entity receives an evidence pack organized by Article 21 measure, with the artifacts a supervisor in its Member State would request.
- Runbooks cover how the group reports to several authorities and how one incident is tracked against each applicable deadline.
- Handover includes the documentation of decisions, owners and open items, so the organization can maintain the program after the engagement closes.
How we support
- Fixed-scope engagements have deliverables and timelines agreed in writing before work starts, and a quote follows from that scope.
- Ongoing support, upgrades and continuous security testing are available as retainers once the initial scope is delivered.
- Before engaging, ask us to confirm which national transposition laws and registration portals your entities must follow, since these are set nationally.
