Under the NIS2 Directive and Slovenia's Information Security Act (ZInfV-1), far more organisations are now expected to take appropriate cyber security measures than before. The list of essential and important entities stretches to mid-sized manufacturers, digital service firms, logistics operators and many businesses that never pictured themselves as critical infrastructure. Even companies left off that list feel the ripple, because their customers must protect their own supply chains and start sending questions down the line. Deciding whether the Act covers you is your lawyer's job. The homework that follows rarely changes: a readable risk assessment, a plan for handling incidents, oversight of suppliers, proper event logs and a board that takes ownership. Apply delivers the technical groundwork and the paperwork, without ever coming on site.
Most NIS2 work is about how the organisation behaves; a smaller share is about technology. Both halves must line up. An unenforced rulebook impresses an auditor or a customer's questionnaire no more than an undocumented firewall does.
First come the facts a lawyer requires to judge your status: registered business activities, headcount and turnover bands, the services you sell, which clients depend on you and how the group is organised. Alongside that we catalogue systems, logins, integrations and third-party providers. The result is a shortfall register mapped to ISO 27001 controls and sorted by risk reduction versus effort, which tells you what to tackle first.
What you own, what threatens it, how likely that is and what it would cost, described for your actual estate: the ERP box, the webshop, workstations next to the production line, Microsoft 365 global admins. Every entry has an owner, a control and a leftover risk somebody signed off. It is concise enough for directors to get through and concrete enough to hold up under questioning, never a doorstop of a manual.
Who raises the alarm, who triages, who has authority to pull the plug and who handles outside communication? Each role gets a named stand-in, and there are ready-made forms for the early warning, a progress update and the final write-up. The playbook also states when an incident goes to the national CSIRT SI-CERT, to URSIV or to a sector authority, and how that dovetails with telling the Information Commissioner about any personal data breach. Your lawyer validates those triggers.
Your accounting software vendor, the remote service link a CNC builder left behind, the web host, an outsourced payroll firm: every one of them can be a way in. We compile a register of critical suppliers, a brief due-diligence form and contract wording on access rights and breach notification. When you are the supplier to a regulated organisation, we also work through the security surveys your clients send you.
Authentication events, privileged actions, firewall records and VPN sessions flow to one central store, device clocks share a common time source and records are kept for exactly as long as your policy states. When you later need to reconstruct an attack and pin down when it began, this is where the evidence lives. Microsoft 365 tenants use Defender and Entra ID telemetry; other estates use whatever tooling is already licensed.
NIS2 makes a point of directors signing off and supervising security measures, and of them understanding the risks themselves. We give the managing director or board a compact online briefing focused on the choices only they can make. Employees receive short sessions on spotting phishing, choosing passwords and reporting anything suspicious to the right person.
Not everything has to land on day one. A business that switches on two-step login and agrees its incident escalation chain early is safer than one with beautifully bound policies and admin accounts nobody protects.
Brief online interviews, configuration checks over remote access and a read-through of existing paperwork. You receive the shortfall register plus a ballpark of the work involved.
Directors choose the order and the spend. The roadmap records what is done immediately, what waits a quarter and which risks are deliberately tolerated.
Two-step login, dedicated privileged accounts, documented patch cycles, EDR across laptops and servers, and backups held out of ransomware's reach. Production changes go into pre-agreed maintenance slots, while the policy set is drafted in parallel.
A scenario-based desk exercise, a trial recovery from backup and a mock phishing campaign. Lessons go into the yearly review cycle, keeping documents current and giving you time-stamped proof for the next client survey.
Out of scope does not mean out of reach. Think of an automotive parts maker in Novo mesto with 60 staff. It may fall outside both categories in the Act, yet the carmaker it delivers to must answer for its own supply chain. Sooner or later a survey lands: is two-step login enforced, are restores tested, how fast would you warn us of a breach, is the factory network walled off from the office? On that day, the supplier holding a brief security policy, a recorded restore test and a written incident playbook is in a much stronger position to keep the business.
A lawyer settles that, since it turns on your sector, size and a few special circumstances. Legal opinions are outside our remit. We supply the inputs the analysis depends on: what you provide and in which sectors, staff numbers and revenue, which customers you serve and whose business would stop if your IT went dark.
For a typical SME the push comes from clients, not regulators. Regulated firms have to vet their vendors and want evidence; cyber insurance applications probe the same topics. A risk register, an incident playbook and a backup that has been test-restored satisfy all of these audiences, whether or not ZInfV-1 names you.
As a rule, the law looks for effective security governance, not a specific badge on the wall. Still, an ISMS modelled on ISO 27001 addresses a large share of what regulators and customers want, so it makes a practical backbone. Apply follows ISO 27001 principles and will support your preparation should you choose to certify. Certification audits are performed by accredited bodies; Apply is not one of them.
URSIV, the Government Information Security Office, is Slovenia's national competent authority for information security. SI-CERT is the national computer emergency response team: it issues alerts and supports organisations handling incidents. We track SI-CERT advisories and can feed published indicators of compromise into your firewall and mail filtering. Your reporting obligations, if any, depend on your status and are written into the playbook based on legal advice.
Financial entities also fall under DORA, whose detailed rules your compliance officer and counsel interpret. Our role there is hands-on technical delivery: configuration, logging, remediation and the technical evidence a reviewer asks for. Compliance judgements remain with you.
Not at all. Apply can deliver the full programme, or only the gap analysis, documentation and rehearsals while routine operations stay where they are. Your existing partner then counts as a supplier in its own right, so we jointly review its access rights, logs and reaction times. Physical work on your premises falls to your staff or that partner; Apply operates remotely and nothing else.
Give us a few lines on your sector, size and IT estate, and mention whether clients have started sending security surveys. Within one working day you will have our proposal for a gap analysis.
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
No town by that name here. Check the letters, or settle for the nearest larger place. Our engineers work only over the internet, so Kočevje and Koper get precisely the same treatment.
