NIS2 compliance is not merely an IT issue. It involves legal, organizational, process management, and technological considerations.
Hungarian regulations follow the logic and control families of NIST SP 800-53 Rev. 5. Therefore, affected organizations must go beyond simply checking off a generic security framework and implement specific, documented, and auditable security controls.
The real question is not whether cybersecurity matters, but whether the organization’s operations, policies, and IT control framework demonstrably comply with NIS2 requirements.
What Does This Mean in Practice?
Applicability Assessment and Classification
We help determine whether your organization is subject to NIS2 and Hungarian cybersecurity legislation. We assess company size, business activities, sector classification, and applicability based on the relevant TEÁOR (NACE) codes.
NIST-Based Gap Analysis
In line with the NIST SP 800-53-based requirements of Decree 7/2024 (MK), we assess your organization’s current cybersecurity maturity. We identify which controls are in place, which are missing, and where policy, technology, or process improvements are needed.
Auditable Operations
We go beyond theoretical compliance by developing a documented, demonstrable system that can be integrated into day-to-day operations. It supports executive decision-making, helps meet regulatory requirements, and prepares your organization for the official cybersecurity audit.
OUR SERVICES
Our NIS2 Service Packages
From a rapid applicability assessment to audit preparation (in Hungarian and/or English).
NIS2 Applicability and Classification Assessment
For organizations seeking to quickly determine whether they are subject to NIS2 and Hungarian cybersecurity regulations.
-
Assessment of company size and business activities
-
Review of sectoral applicability
-
Preliminary screening based on TEÁOR (NACE) codes
-
Preliminary determination of “essential” or “important” entity status
-
Review of SZTFH registration obligations
-
Brief executive summary with recommended actions
Duration: 3–4 weeks
NIS2 Gap Assessment
For medium-sized and large enterprises that know or suspect they are subject to the regulations and want to understand how far they are from compliance.
-
Assessment of current cybersecurity practices
-
Comparison of NIST SP 800-53-based control requirements against existing operations
-
Preliminary review of electronic information systems (EIRs)
-
Identification of gaps and risks
-
Prioritized list of required actions
-
Executive summary and recommended implementation roadmap
Duration: 6–8 weeks
NIS 2 Audit Readiness Program
For organizations seeking comprehensive preparation for the official cybersecurity audit.
-
Development of a risk assessment methodology
-
Support with the classification of electronic information systems (EIRs)
-
Preparation of mandatory policies
-
Support with Information Security Policy (IBSZ), Business Continuity Plan (BCP), and Disaster Recovery Plan (DRP) documentation
-
Review of supplier cybersecurity controls
-
Cybersecurity awareness support for management and employees
-
Pre-audit assessment and audit preparation workshop
-
Provision of an external Information Security Officer (IBF), upon request
Duration: 8–12 weeks
5 STEPS
How We Work
Our approach is audit-oriented, structured, and fully documented. Our goal is not to burden your organization with excessive security measures, but to establish a practical and sustainable cybersecurity framework that meets regulatory requirements.
Applicability Assessment
Classification and Registration Support
Risk Analysis and Control Assessment
Documentation and Action Plan
Audit Preparation and Executive Summary
Why MagiCom?
20+ Years of IT and Information Security Experience
Understanding of the Auditor ’s Perspective
A Practical, Business-Focused Approach
Combined NIST, ISO 27001, and NIS2 Expertise
FAQ
Our Clients’ Most Frequently Asked Questions
This is determined by a combination of company size, sector classification, and business activities. As a general rule, organizations that qualify as at least medium-sized enterprises and operate in an affected sector may be subject to the requirements. However, in certain cases, the regulations may apply regardless of company size.
The regulations categorize organizations based on risk and sector-specific criteria. This classification may affect supervisory expectations, audit requirements, and compliance obligations.
EIR stands for Electronic Information System. A key step in achieving NIS2 compliance is identifying the electronic information systems used by the organization, the business processes they support, and the security class to which they belong.
RBT is the Hungarian abbreviation for a System Security Plan. This document describes the security requirements met by the relevant information system, the controls in place, and the measures required to maintain the appropriate level of security.
The required documentation may vary by organization, but typically includes an information security policy, incident response procedures, access control policies, a Business Continuity Plan (BCP), a Disaster Recovery Plan (DRP), supplier security requirements, and cybersecurity awareness materials.
Common issues include incomplete documentation, insufficient evidence that controls are operating effectively, poorly managed access rights, inadequate logging, missing risk assessments, inaccurate classification of electronic information systems (EIRs), and unclear management responsibilities.
This depends on the organization’s size, IT environment, and current level of cybersecurity maturity. A rapid applicability assessment can be completed within a few weeks, while comprehensive audit preparation typically requires a structured program lasting several months.
