The EU requirements for cybersecurity and digital resilience have to be turned into concrete, documented IT operations. We carry out the gap analysis, close the gaps and build the documentation into everyday operations, so you have answers when the supervisory authority or your customers ask.
NIS2 and DORA are the EU's two major sets of rules for cybersecurity and digital resilience.
NIS2 is a directive that sets binding requirements for risk management, incident reporting and management accountability in 18 critical sectors, while DORA is a regulation aimed at the financial sector, which has applied since 17 January 2025 and also reaches the sector's IT suppliers. Common to both: the requirements have to be turned into concrete, documented IT operations, or you will not pass supervision.
MI Support IT delivers exactly that layer: a gap analysis of your technical security, ICT risk management in daily operations, a tested contingency plan, processes for incident reporting, management and documentation of IT suppliers, plus ongoing reporting that makes the work provable to management, auditors and authorities.
You get one supplier who knows the requirements from both the SME side and the regulated financial sector, and who builds compliance into operations instead of handing over a report that gathers dust.
Who is covered
The first step in any engagement is clarifying which requirements actually apply to your business.
NIS2 covers essential and important entities in 18 critical sectors, including energy, transport, health, food, digital infrastructure and manufacturing. The main rule: at least 50 employees or annual turnover above EUR 10 million in one of the sectors, but there are exceptions both ways. The directive has been implemented in Danish law, and registration and supervision are handled by Styrelsen for Samfundssikkerhed (the Danish Agency for Civil Protection).
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 and applies directly, without separate Danish legislation. It covers banks, insurance and pension companies, payment institutions and other financial entities, and reaches their ICT suppliers: contracts must contain specific terms, supplier relationships must be registered and monitored, and critical ICT providers are subject to joint European oversight. Finanstilsynet (the Danish Financial Supervisory Authority) supervises in Denmark.
If you are not covered yourself, your customers may be, and they have to set security requirements for their suppliers. If you are in doubt, we clarify it as the first step in the process. Also read the glossary entries on NIS2 and DORA for the details of each set of rules. NIS2 guide: requirements, deadlines and who is covered · NIS2 in the glossary · DORA in the glossary
The services
The requirements in NIS2 and DORA overlap heavily with good IT security operations. You get them as one combined, ongoing service with the documentation built in.
A systematic review of your technical security against the requirements, resulting in a prioritised list of the gaps.
See the IT security checkAccess management, updates, monitoring and endpoint protection as regular operations, not as an annual project.
See our full IT security workA written, rehearsed plan for the first 24 hours and the way back to normal operations, ready to be shown.
Read about IT contingency planningDocumented backup of servers and Microsoft 365 with regular recovery tests, the backbone of the requirements in practice.
See the backup solutionsOngoing training of management and employees with phishing tests, so the organisational layer can be documented too.
Read about IT security trainingProcesses for classifying and reporting incidents, plus management and documentation of your IT suppliers, including the documentation your customers ask for.
The experience comes from the regulated reality: among other things, we provide security advisory to AP Pension, where the task is to protect sensitive customer data in a heavily regulated sector. See the AP Pension case
The process gives you progress from week one, with a prioritised plan instead of a generic report.
Book a no-obligation meetingClarifying whether and how NIS2 or DORA applies to your business, and which requirements actually need to be met.
A technical review of your environment against the requirements, with prioritised findings and an action plan.
The gaps are closed: technical controls, contingency plan, backup testing, training and processes for reporting.
Compliance is maintained in ongoing operations, with reporting that makes the work provable year after year.
Price
The gap analysis is carried out as our IT security check at a fixed price from DKK 15,000. That gives you a prioritised overview before you commit to anything more.
The rest of the process is priced after the gap analysis, once the scope is known. You get a quote before work starts.
FAQ
You get an honest picture of the distance to the requirements before the supervisory authority or your customers give it to you. Call, or book a meeting.
