Zgodność z NIS2

Jak Google Workspace i Cloud Tender pomagają spełnić wymogi bezpieczeństwa dyrektywy NIS2.

Zarządzanie ryzykiem i kontrola dostępu
Obsługa i zgłaszanie incydentów
Szyfrowanie i uwierzytelnianie wieloskładnikowe

Ten artykuł nie jest jeszcze w pełni przetłumaczony na ten język — poniżej wersja angielska.

NIS2 Directive

What does compliance involve, and how should your organisation get started?

The following material preserves the topics from our original Hungarian service page. Its Hungarian legislation references, fees and 2024–2025 milestones are historical information, not current legal advice or a determination of your organisation’s obligations. Applicability, deadlines and national implementation require specialist review. Google Workspace alone does not establish NIS2 compliance.

Organisations within designated sectors

The original Hungarian page describes organisations with more than 50 employees and annual turnover above EUR 10 million. These figures are source context, not a complete eligibility test: sector, size-calculation rules, exceptions and national legislation also matter.

Main objectives of cybersecurity assurance

Emphasise the additional responsibilities of company management.
Operate an information-security management system.
Maintain risk-analysis and risk-management processes, with protective measures to reduce risks.
Operate an incident-management process and meet applicable reporting obligations. The original page describes an initial notification within 24 hours, detailed information within 72 hours and a full technical investigation/report within 30 days. Exact requirements depend on the incident and applicable law.
Strengthen business continuity.
Maintain protection throughout the lifecycle.
Address personnel and physical security.
Improve security awareness.
Improve supply-chain security, including suppliers and subcontractors.

Cybersecurity objectives from the original Hungarian source

Depending on an organisation’s information-security maturity, these expectations may extend practices already in place rather than introduce entirely new ones. They broaden the range of organisations covered and establish more consistent, demanding expectations.

Organisations should plan for the resources and costs associated with supervision, audits and remediation of identified gaps. The historical source mentions supervisory fees and audit costs; it is not a current quotation or fee schedule.

Highly critical sectors — essential entities

The source page lists:

Energy
Transport
Healthcare
Drinking water and wastewater
Electronic communications services
Digital infrastructure
Outsourced ICT services
Space-related services

Other critical sectors — important entities

The source page lists:

Postal and courier services
Food production, processing and distribution
Waste management
Chemical production and distribution
Manufacturing
Digital service providers
Research

How our expert team can help

Migrating your business to Google Workspace

We can assist with migration planning and Google Workspace configuration. Security requirements must be evaluated against the selected edition, settings and your organisation’s responsibilities; no cloud service automatically satisfies every regulatory requirement.

The original page quoted a 99.9999% availability figure and described protection against any data loss. Those statements are not presented here as verified guarantees. Applicable availability commitments are governed by Google’s current service terms; resilience does not eliminate every operational or data-loss risk.

Google Workspace supports encryption in transit and at rest. The source describes encrypted files being stored across multiple data centres for resilience. Backup, recovery, access control and continuity requirements still need an organisation-specific assessment.

Monitoring Google Workspace security

Cloud Tender specialists can help review the security posture of your Google Workspace environment. Appropriately configured alerts support investigation, timely intervention and preventive measures. The scope of ongoing monitoring must be agreed for the particular engagement.

Security training for users and administrators

For administrators, we explain ways to help protect business systems against data leakage and external attacks.

For users, we build security awareness by covering threat recognition and practical account-protection methods in everyday workflows.

Our training uses workshop-based activities so participants can practise what they learn. The original service description explains that workshop material draws on experience with real attacks and attempts to obtain data, helping participants relate the lessons to realistic situations.

Request a consultation

European and Hungarian context

NIS2 is an EU directive intended to establish a high common level of cybersecurity. It entered into force in 2023 and sets obligations for Member States, covering sectors important to the functioning of the economy.

The original Hungarian page identifies the Supervisory Authority for Regulated Activities (SZTFH) as the authority responsible for national cybersecurity certification tasks. It refers to Hungary’s Act XXIII of 2023 on cybersecurity certification and cybersecurity supervision, and describes implementation steps leading up to 18 October 2024. These references are retained as historical source context, not a statement that the cited framework or dates remain current.

Historical compliance milestones from the Hungarian source

18 October 2024

The source mentions payment of an annual supervisory fee and a figure of 0.015% of the preceding year’s turnover. Its extracted fee text is incomplete; do not use it to calculate a current obligation.

31 December 2024

The source describes contracting with an auditor for the first cybersecurity audit within 120 days of registration, and no later than 31 December 2024 for an affected organisation operating before 18 October 2024.

31 December 2025

The source gives this as the deadline for completing the first cybersecurity audit, and describes repetition every two years. All of these dates and timing statements require review against current applicable legislation before being used for planning.

Coverage independent of size

The source also identifies categories or circumstances in which size thresholds may not be decisive:

Public electronic communications, trust-service providers and top-level-domain registries.
DNS service providers and domain-name registration services.
Critical entities identified under the CER Directive (EU) 2022/2557.
Services whose disruption could significantly affect public protection, public health or public safety.
Public-administration bodies as defined by national law.
Entities of particular national or regional importance.
A sole provider of a service essential to maintaining critical social or economic activities.

The original page describes security classification of information systems as basic, substantial or high, with protective requirements depending on the classification. It refers to an implementing regulation expected in early 2024; that is an archived reference, not current guidance.