NIS2 compliance

Croatia transposed the NIS2 directive through the Cyber Security Act (Zakon o kibernetičkoj sigurnosti). Entities in scope are classed as essential or important depending on sector and size, and they share the same core obligations:

• managing cyber risk through documented measures, from access control and backups to supplier security
• reporting significant incidents to the competent authority: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report after that
• management responsibility: the board approves the measures, oversees how they are carried out and answers for failures

Many companies are not in scope themselves but work for ones that are, so their clients send them security questionnaires asking the same things.

We start with a conversation with management and whoever runs IT. Then we look at how things actually are: who has administrator rights, where backups go and whether they have been tested, how systems are updated and which suppliers have access to the network. Each measure is compared with what exists, and the gap is written down.

Where a measure exists but is not documented, we document it. Where it does not exist, we propose the simplest way to put it in place.

We pay particular attention to suppliers: who maintains the accounting software, who has remote access to the till or the server, and on what terms. The law requires that risk to be assessed too, and it is exactly the part that often gets skipped.

A risk assessment, a list of measures and the people responsible for them, a remediation plan ordered by importance, and an incident reporting procedure with contacts and an early warning template. We try the procedure out in a short scenario exercise, to see who calls whom and how long it takes to gather the details for a report.

A legal opinion on whether you are in scope in borderline cases comes from a lawyer or the competent authority. We prepare the technical and organisational side.