NIS2 compliance is not merely an IT issue. It involves legal, organizational, process management, and technological considerations.
Hungarian regulations follow the logic and control families of NIST SP 800-53 Rev. 5. Therefore, affected organizations must go beyond simply checking off a generic security framework and implement specific, documented, and auditable security controls.
The real question is not whether cybersecurity matters, but whether the organization’s operations, policies, and IT control framework demonstrably comply with NIS2 requirements.
What Does ISO 27001 Mean in Practice?
NIS2 compliance is not merely an IT issue. It involves legal, organizational, process management, and technological considerations.
Risk-Based Approach
Not every organization needs the same controls. We start by assessing the actual business, technological, and information security risks.
Documented and Verifiable Controls
ISO 27001 requires more than “this is how we usually do things.” Responsibilities, processes, decisions, and controls must be clearly documented and verifiable.
Continuous Improvement
ISO 27001 is not a one-time compliance project. The ISMS is based on regular reviews, measurement, internal audits, management reviews, and continuous improvement.
Who is ISO 27001 particularly important for?
NIS2 compliance is not merely an IT issue. It involves legal, organizational, process management, and technological considerations.
Regulated organizations and those with high information security risks
ISO 27001 can be particularly important for organizations where business continuity or the security of customer data is critical, including:
-
financial service providers,
-
healthcare organizations,
-
energy and utility companies,
-
telecommunications companies,
-
organizations operating critical or business-critical services.
ISO 27001 does not replace compliance with the specific requirements of NIS2 or other sector-specific regulations. However, it can provide a well-structured information security management foundation for meeting these requirements.
IT service providers, SaaS companies, and technology companies
If an organization has access to other companies’ systems or data, information security is no longer just an internal matter.
This can be particularly relevant for:
-
software developers,
-
SaaS providers,
-
data centers and cloud service providers,
-
IT outsourcing companies,
-
managed service providers,
-
IT operations and security service providers.
An auditable information security management system can help demonstrate to clients that their data and systems are handled in a controlled and secure environment.
Suppliers to large enterprises and companies participating in tenders
It is not uncommon for organizations to face detailed information security requirements during large enterprise vendor assessments, supplier audits, or tender processes.
In such cases, ISO 27001 certification is not only an information security matter but can also be an important factor in winning new business and demonstrating supplier eligibility.
A well-structured ISMS can also significantly simplify the process of responding to customers’ information security questionnaires, audits, and supplier assessments.
Organizations handling large volumes of or sensitive information
When handling personal data, trade secrets, intellectual property, financial information, or customer data, it is particularly important that organizational and operational controls can be demonstrated alongside technical measures.
ISO 27001 provides a systematic framework for this. However, implementing the standard does not automatically ensure GDPR compliance.
The ISO 27001 Implementation Process
From the initial assessment to the certification audit – in 4 structured steps.
We support your organization throughout the entire ISO 27001 implementation process – in both Hungarian and English.
Assessment and Implementation Program Development
The first step is to assess how well the organization’s current operations meet the requirements of ISO/IEC 27001:2022 and identify the steps needed to implement the system.
-
Assessment of the current state based on interviews and document reviews
-
Identification of gaps and areas for improvement
-
Definition of the ISMS scope
-
Identification of the processes, organizational units, or sites to be included in the certification scope
-
Development of a realistic timeline and implementation program leading up to the certification audit
Outcome:
A clear overview of the current situation and a well-defined project plan showing how the organization can move from its current state to audit-ready operations.
Risk Assessment and Controls
At this stage, we help identify the threats, risks, and controls that are truly relevant to the organization’s operations.
-
Development of a risk assessment methodology
-
Identification and assessment of information security risks
-
Selection of the necessary controls based on ISO 27001 requirements
-
Support in preparing the relevant policies and documentation
-
Development of the Information Security Policy and Statement of Applicability (SoA)
-
Preparation of other required ISMS documentation
We use proven templates and methodologies, while tailoring all documentation and control measures to the specific needs and operations of each organization.
System implementation and awareness
Documentation alone does not make an information security management system effective. Rules, responsibilities, and controls must also be integrated into day-to-day operations.
-
Development of a risk assessment methodology
-
Support with the classification of Electronic Information Systems (EIS)
-
Preparation of mandatory policies
-
Support with Information Security Policy, Business Continuity Plan (BCP), and Disaster Recovery Plan (DRP) documentation
-
Review of supplier cybersecurity controls
-
Support for management and employee security awareness
-
Pre-audit and audit preparation workshop
-
Provision of an external Information Security Officer upon request
A policy only creates value when the organization actually knows, understands, and applies it in its day-to-day operations.
Risk assessment and controls
At this stage, we help identify the threats, risks, and controls that are truly relevant to the organization’s operations.
-
Development of a risk assessment methodology
-
Identification and assessment of information security risks
-
Selection of the necessary controls based on ISO 27001 requirements
-
Support in preparing the relevant policies and documentation
-
Development of the Information Security Policy and Statement of Applicability (SoA)
-
Preparation of other required ISMS documentation
We use proven templates and methodologies, while tailoring all documentation and controls to the specific needs and operations of each organization.
HOW DO WE WORK?
The goal is not the certificate, but the system behind it.
We are not here to create an artificial system on behalf of the organization that only works for audits.
Our goal is to embed information security into the organization’s day-to-day operations while making the implementation process faster, more structured, and more predictable.
The result is not simply a certificate to hang on the wall, but a truly effective Information Security Management System (ISMS).
Practical approach
We don’t just hand over a set of templates
Only the controls that are truly necessary
Combined IT and information security expertise
Audit preparation
Why MagiCom?
20+ years of IT and information security experience
Understanding of the auditor’s perspective
A practical, business-focused approach
An integrated NIST, ISO 27001, and NIS2 approach
FAQ
Our clients’ most frequently asked questions
ISO/IEC 27001 is the international standard that specifies the requirements for an Information Security Management System (ISMS), known as IBIR in Hungarian. It provides a framework for managing information security risks and for establishing, operating, and continually improving the management system.
The current base edition is ISO/IEC 27001:2022. In 2024, ISO also published an applicable amendment, ISO/IEC 27001:2022/Amd 1:2024.
Generally, no. The standard can be implemented without certification, and the organization may decide to have its system certified by an independent certification body at a later stage.
However, if certification is required by a client, tender, or supplier requirement, obtaining the certificate may become a specific business requirement.
Not automatically.
ISO 27001 and NIS2 cover many of the same information security areas, but Hungarian cybersecurity regulations set out separate, specific requirements. The current legal framework for cybersecurity in Hungary is based on Act LXIX of 2024 on the Cybersecurity of Hungary.
Therefore, if your organization falls within the scope of NIS2, we recommend conducting a separate compliance assessment.
Learn more about our NIS2 services: https://www.magicom.hu/informaciobiztonsagi-tanacsadas/nis2
The duration of the project depends on several factors, including:
-
the size of the organization,
-
the scope of the ISMS,
-
the number of sites and systems,
-
the existing level of policies and controls,
-
the organization’s information security maturity,
-
the required technological improvements,
-
and the planned date of the certification audit.
Following an initial Gap Analysis, a realistic project timeline can be defined.
-
A person or organizational function with sufficient oversight and authority over the relevant business, IT, and information security processes.
However, an ISMS cannot be a one-person project. Effective implementation may require collaboration between management, IT, HR, legal/compliance, procurement, and the relevant business functions.
We also help establish a clear structure of roles and responsibilities.
Exactly as much as is justified by the requirements of the standard, the organization’s risks, and its actual operations.
We do not recommend creating dozens of policies that the organization will be unable to maintain or apply in practice.
Good ISO 27001 documentation is not about length. It is about being clear, practical, and demonstrably effective.
When selecting a certification body, it is worth considering factors such as its professional experience, accreditation, industry-specific expertise, audit language, availability, and commercial terms.
Certification is always carried out by an external organization independent of the consultant. Accreditation can provide additional independent assurance of the certification body’s competence.
We can also help you identify the key criteria for selecting the right certification body.
