Cyber readiness check
For SMEs, critical infrastructure operators and suppliers who want to know where they stand before an incident shows them.
Updated: 2026-11
The cyber readiness check establishes whether your company detects an attack in time, responds correctly and reports on time: review of reporting duties under the ISA, FADP and NIS2 where relevant, inventory of the attack surface, review of cloud and Microsoft 365 baseline configuration, backup recoverability, an incident response plan and a tabletop exercise.
Many companies invest in security products without knowing whether they can act in an emergency. Who reports within 24 hours? Does restore work? Which systems are reachable from the internet at all?
Since 1 April 2025 the ISA reporting obligation has applied to critical infrastructure, with fines since October 2025. Suppliers receive the requirements by contract.
What you get
Duty analysis
Applicability of the ISA, FADP, GDPR and NIS2 with channels and deadlines.
Attack surface
Inventory of internet-facing domains, services and access points with issues.
Baseline configuration
Review of key settings in Microsoft 365 and cloud, such as multi-factor sign-in and admin rights.
Incident response plan
Roles, contact details, decision rights and all reporting channels.
Tabletop exercise
A realistic scenario with debrief and action list.
How it runs
- 01
Duties
Clarify legal applicability and reporting channels.
- 02
Review
Examine attack surface, configuration and backups.
- 03
Plan
Develop the incident response plan.
- 04
Exercise
Run a scenario, close gaps.
Price framing
A fixed-scope package by company size. Penetration tests are not included and are carried out with specialised partners where needed.
Indicative, not a binding quote — the frame is confirmed during scoping.
Parent service: Cyber readiness & IT security
FAQ
Is this a penetration test?
No. The check reviews organisation, attack surface and baseline configuration. We recommend a pentest where it makes sense and carry it out with specialised partners.
Are we subject to the reporting duty?
We clarify that first based on the ISA. Even without the duty an emergency plan is needed, for example for data breach notifications.
Do we need new software?
Not necessarily. The check shows where the gaps are; many can be closed with existing means.
How often should it be repeated?
The exercise annually, the attack surface inventory continuously, the duty analysis when the business changes.
Cyber readiness check
For SMEs, critical infrastructure operators and suppliers who want to know where they stand before an incident shows them.