Compliance is the floor. Here’s how to set the ceiling.
NIS2 tells you the minimum. It cannot tell you what your business is willing to lose, and that is the number your security programme should be sized against.
Resources
What we're working out in the open.
Nothing published under this topic yet.
Nothing published under this topic yet.
Cyber threats do not skip small and medium enterprises
One in four Dutch SMEs has already been hit. The reasons they are targeted are the same reasons the defenses are thin.
Cybersecurity debt: the hidden risk that gets more expensive over time
Unresolved exposures do not sit still. They accumulate, and the longer the backlog is carried the more the eventual incident costs.
Why applying a framework well beats chasing the next one
ISO 27001, NIST CSF and ISO 31000 overlap more than they differ. The gap is never the framework. It is the application.
From reading to measuring
Reading about exposure is not measuring it.
Everything here argues the same thing: the floor is not the target. Two weeks tells you where your estate actually sits between them.
Request an exposure assessment
Prefer to talk first? 20 minutes with a founder →
Two weeks · one business service · EU-hosted, deleted after 30 days
Example extract · the bandwidth paper
section
pages
The floor is not the target
3
What appetite fixes
4
Drawing the bandwidth
5
Worked example
4
Board template
2
18 pages
pdf · no gate on request
Static example. The paper ships with the assessment too.