01
Scope and audit findings
We review findings, services, suppliers and existing safeguards. Together with the company and the person responsible for legal assessment, we establish relevant requirements and identify missing information.
Compliance implementation
Preparing your business for NIS2
We help turn NIS2 audit findings into tasks for management, IT and service owners. We prepare procedures, implement agreed safeguards and check how they work. You receive a work plan, documented results and a list of matters requiring further decisions and reviews.
Trusted by
Companies and institutions that need stable IT.
From audit findings to changes
An assessment identifies security conditions and gaps; implementation delivers agreed changes and checks procedures. We combine IT, documentation, incident handling, continuity, suppliers and training. In Poland, the reference is the National Cybersecurity System Act (KSC), amended on 23 January 2026. For entities covered by the transitional provisions, self-registration ended on 3 October 2026; we first check qualification and the required register entry. The relevant group must implement its obligations and begin using the S46 incident-handling system by 3 April 2027. Status and deadlines are determined for the specific entity.
Related implementation services
Work is selected according to risk and audit findings. Not every company needs a new tool in every area.
IT safeguards
Protection for accounts, devices, email and networks. Updates, secure configuration, network segmentation, user role separation and prioritised vulnerability remediation.Backup and recovery
Backup schedules, protection, retention and separation. Data and service recovery tests with recorded results and limitations.Security event analysis
Log sources, alerts and incident escalation. Integration with security event analysis (SIEM) and the team’s work are agreed separately.DORA implementation
A separate scope for organisations also considering DORA. We coordinate shared IT risk, supplier and testing work without treating the two regulations as equivalent.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateNIS2 implementation process
Before implementation starts, we agree scope, costs, scheduling and responsibilities. Audit recommendations do not automatically authorise changes.
02
Plan and responsibilities
We agree priorities, budget, dependencies and acceptance criteria. Tasks are divided between Virtline, your team and suppliers; the company appoints service owners and approves decisions.
03
Procedures and safeguards
We prepare documentation, implement agreed configurations and practise incident response with the team. The procedure sets out classification, escalation, communication, timeframes and reporting responsibilities within the agreed scope.
04
Checks and handover
We compare results with acceptance criteria, identify tasks that still need to be completed and record decisions on exceptions. We provide documentation and a plan for the post-implementation audit and recurring reviews. Later maintenance requires a separate agreement. The post-implementation review is an internal or advisory assessment. A statutory audit of an essential entity has separate requirements and deadlines determined for that entity.
Practical scope
What implementation delivers
The records show what was done, what was checked and what remains open. Each item has someone responsible for keeping it up to date.
Requirements, including NIS2 Article 21 measures, linked to services, risks and tasks. We record priorities, costs, dependencies, dates, approvers and completion status.
Security, access, incident handling, continuity and training arrangements. Risk, service, exception and IT supplier registers cover dependencies, supplier importance, contract terms under review and contingency plans.
Change records, access reviews, event logs and test reports. Recovery results are assessed against agreed objectives: acceptable data loss and target service restoration time (RPO/RTO). Gaps and owner decisions are recorded.
A schedule for backup tests, incident exercises and reviews of access, risks and suppliers. We include training and exercise results, attendance records, corrective actions, procedure updates and a post-implementation audit schedule.
Decisions and oversight stay with you
Virtline is responsible for the agreed work, its documentation and checks. Management and designated owners approve scope, budget, procedures and risk decisions. Commissioning the project does not transfer the organisation’s statutory duties to Virtline. We establish legal scope and deadlines with the person responsible for the company’s legal assessment, based on current legislation rather than its sector name alone. Acceptance of changes is not a guarantee of compliance or freedom from incidents; outstanding gaps remain recorded. Service hours, alert response and recurring reviews are defined within the scope of later support.
Questions about NIS2 implementation
Can we start with another provider’s audit?
+
We can use existing findings after checking their scope, currency and supporting material. If information is missing, we agree an additional review. A report alone does not establish the cost and full scope of implementation.
Do we need to buy new security tools?
+
We do not assume that upfront. We review existing tools and configuration: multi-factor authentication (MFA), endpoint protection (EDR), remote access, monitoring, backups and email. We include mobile devices, administrator accounts, supplier access, revoking permissions and MFA exceptions. Purchases follow identified gaps and risks.
Are policies and procedures enough?
+
Documents should describe how work is actually done. The scope therefore connects them with configuration, training, incident exercises, recovery tests and reviews. We record results and actions needing improvement; approving procedures alone does not confirm that safeguards work.
Can we use our existing ISO 27001 system?
+
Yes, where its scope fits the planned work. We can reuse risk assessments, roles, registers and review cycles, then address identified gaps. ISO 27001 does not replace an assessment of NIS2 requirements, and Virtline’s certificate covers Virtline, not the client organisation.
Plan the next step after your audit
Describe important services, sites and user numbers, IT suppliers and the most urgent audit findings. Tell us your decision timeframe and current safeguards. If you have no audit, explain what needs clarification. Do not send passwords or a confidential report in your first message.
Plan your NIS2 implementation