NIS2: what a company should check

Client reviews are published on this page only after verification, and DRJ Cloud does not write reviews on behalf of its clients. Until verified reviews are available, this space describes how we work. One technical manager is responsible for each client, from the IT audit to the monthly follow-up, and every request receives a written answer, so you always know who is responsible for your systems.

Administrator accounts, licences such as Microsoft 365, domain names, supplier contracts and documentation remain in your company's name. DRJ Cloud works through delegated access, which you can review at any time. If you change provider, you keep the keys, the passwords and the full history of your systems, and the handover does not depend on us.

Each month, you receive a written report: tickets handled, incidents, patches applied, backups tested and security alerts. The report is written for management as well as for technical staff. It shows what was done, what remains open and what we recommend for the coming month, so that decisions rest on facts.

Servers, devices and the network are monitored 24/7. Support is available Monday to Friday, from 8 am to 6 pm, and emergencies are handled 24/7.

Backups follow the 3-2-1 rule, with an off-site and immutable copy. Restores are tested regularly and the results are documented, because a backup that has never been restored remains an assumption. A written disaster recovery plan sets out who does what, in which order and with which priorities, and it is exercised with your team. When an incident occurs, the plan is already known, the contacts are already listed and the decisions have already been prepared. You know which systems come back first and how the business continues in the meantime.

Your servers and applications are hosted in data centres located in the European Union, in a private cloud or in a public cloud such as Microsoft Azure. Monitoring and backup are included in the hosting service.

For NIS2 and GDPR, we start with an assessment of the current situation, then build the record of processing activities, the security policies and the access rules that your organisation needs.

Logs and documented evidence are kept up to date, so that you can respond to an inspection or a client audit with facts. We support you during these checks and audits, without replacing your legal adviser.

The IT audit is delivered in writing within 48 hours. It covers the inventory of your equipment, security, backups, access and licences, and it ranks priorities in a clear order. There is no obligation to sign a monthly contract afterwards. You can carry out the recommendations with your own team, with another provider or with DRJ Cloud, and the document remains yours.

Before any change, we document your environment: users, devices, servers, network, licences and suppliers. This documentation belongs to you and is kept up to date throughout the contract. It allows a new colleague, an internal IT manager or another provider to understand your systems quickly, and it ensures that knowledge of your IT does not depend on one person.