Blog
Insights on security and NIS2
Practical guidance on cybersecurity, NIS2 compliance and running a secure business, from the CloudSignLab team.
NIS2 evidence checklist: what to keep for each Article 21 measure
The records and proof that show your NIS2 measures work, measure by measure, and how to keep them current without a pile of folders.
What is NIS2, exactly? A plain-language guide for busy companies
NIS2 explained without the legal jargon: who it applies to, what it asks for, the 24-hour reporting rule, and how to get ready step by step without drowning in spreadsheets.
NIS2 incident reporting: 24 hours, 72 hours, one month
What counts as a significant incident under NIS2, what you must report in the first 24 hours, after 72 hours and after one month, and how to be ready before something happens.
DORA register of information: what it is and how to start
Under DORA, financial entities keep a register of their contracts with ICT third-party providers. What goes in it, who needs it and how to start.
Supplier security under NIS2: what your customers will ask you
NIS2 makes covered companies responsible for the security of their suppliers. Here is what that means for you as a supplier, which questions to expect, and how to answer them once instead of every time.
The ISO 27001 Statement of Applicability, explained
What the Statement of Applicability is, what it must contain under ISO/IEC 27001:2022, and how to keep it useful instead of a document nobody reads.
NIS2 for small suppliers: not covered, but still asked
Most companies with fewer than 50 people are outside NIS2. Their customers are not. A practical minimum of security that small suppliers can put in place, and show, without a compliance team.
How to answer customer security questionnaires without losing weeks
Customers under NIS2 and other rules check their suppliers with security questionnaires. A simple way to answer faster, consistently and with proof.
Cyber Resilience Act: what manufacturers must report from 11 September 2026
The CRA's reporting duties start before its other obligations. What counts, the deadlines and how manufacturers can prepare now.