Our blog features practical articles on cybersecurity and regulations, written in plain language that business owners and managers can understand. We cover specific topics such as NIS2, DORA and CRA requirements, ISO 27001 implementations, incident analysis, phishing, ransomware and best practices for SMEs.
Instead of technical jargon we offer actionable guidance that can be applied to your business straight away. We focus on content you can implement immediately: checklists, threat analyses, SME guides and regular updates on new regulations.
Poland’s Cybersecurity Market Is Growing. How Should Companies Plan Budgets and Choose Providers?
Poland’s cybersecurity market is growing because cyberattacks, digitalisation, NIS2 and national cybersecurity pressure, and funding from KPO, FBiO and EU programmes are increasing at the same time. For companies, this means cyber budgets should not be planned as one-off IT purchases, but as a resilience programme: MFA, backup, EDR, monitoring, supplier assessment, training, incident response, BCP, DRP, ISMS and board reporting. For IT and security providers, this means rising demand, but also higher customer expectations. The winners will not be those who sell the most tools, but those who deliver working resilience, compliance evidence and post-implementation maintenance.
Prepared by: CCyber Editorial Team
Note: This article is educational and strategic. It is not investment advice, a recommendation to buy or sell shares, or brokerage advice.
Poland’s cybersecurity market is growing because companies, public institutions and digital service providers are dealing with more attacks, stronger dependence on cloud and SaaS, NIS2 and national cybersecurity requirements, customer expectations, cyber insurance and public funding for digitalisation and resilience. For customers, this means cyber budgets must be planned wisely. Buying a tool is not enough. Organizations need to build capability: risk management, MFA, backup, EDR, monitoring, incident response, supplier assessment, training, compliance evidence and board reporting. For providers, this means a larger market, but also greater responsibility. The winners will increasingly be companies that can combine technology, regulation, governance, managed services and real security maintenance.
July 2026
The growth of the cybersecurity market in Poland shows that companies are no longer treating security as an IT add-on. It is increasingly becoming part of strategy, continuity, contractual requirements, board-level accountability and the cost of digital business.
This is an important mindset shift. A few years ago, many organizations invested mainly after an incident or when a customer required an audit. Today cyber budgets appear earlier: before audits, before NIS2 implementation, before buying cyber insurance, before entering a new contract or before digital transformation.
Cybersecurity has become a cost of organizational resilience. A company may have the best product, production, sales and team, but if it loses access to email, ERP, finance system, cloud, warehouse, customer data or production systems, it stops operating normally.
That is why the right question is not: how much does cybersecurity cost? A better question is: how much does one day without systems, data, invoicing, production, customer service and communication cost?
The number of cyber incidents and reports in Poland is growing quickly. This means companies are not investing in cyber because it is fashionable. They invest because they see real risk: phishing, BEC, ransomware, account takeover, data leaks, edge system vulnerabilities, supplier attacks and DDoS.
NIS2 and national cybersecurity rules require a system-based approach to risk. Organizations need owners, processes, procedures, evidence, reporting, incident notification, supplier assessment and training. This drives demand not only for tools, but also consulting, audits, implementation and maintenance.
Companies move processes to cloud, use more SaaS tools and integrate systems through APIs. This improves efficiency, but creates new risks: misconfiguration, shadow IT, uncontrolled supplier access, missing logs, missing SaaS backup and dependence on many digital services.
Services and software are becoming more important than hardware alone. This is a natural direction. A firewall, server or licence matters, but it is not enough. Organizations need people, processes, configuration, monitoring, tests, reports and incident response.
For customers, a growing market means more provider choice, but also greater risk of buying wrong solutions. When cybersecurity becomes fashionable, many offers appear promising quick security, compliance and resilience. Not every offer really delivers that.
For providers, market growth is an opportunity, but also a maturity test. Customers will need not only sales, but responsible delivery, post-implementation support, board reporting, incident handling and compliance evidence.
Many companies are still determining whether they fall under new obligations. This creates demand for applicability assessment, gap assessment, ISMS, documentation, risk register, incident reporting procedures and board reporting.
Most organizations will not build their own 24/7 security centre. They will need monitoring, alert handling, triage, escalation, reporting and incident support services.
Ransomware makes backup, restore testing, DRP and BCP one of the first board-level topics. Organizations increasingly ask not only whether backup exists, but whether it has been tested.
MFA, IAM, PAM, access review, supplier accounts and remote access are the foundation of security. This area will appear in almost every regulatory and insurance project.
Companies use Microsoft 365, Google Workspace, CRM, HR, finance, e-commerce and AI tools as SaaS. They need configuration control, backup, logs, DLP, identity management and access policies.
Manufacturing, energy, water utilities, transport, food and technical infrastructure require OT protection. This area is more demanding than classic IT, but increasingly necessary.
NIS2 and national rules require training, but the real need is broader. Companies must teach people about phishing, BEC, MFA, incident reporting, data handling and safe AI use.
AI will increase cybersecurity demand in two directions. First, companies will buy AI tools supporting threat detection, alert analysis, response automation and vulnerability management. Second, they will need to secure AI use itself: policies, data controls, shadow AI protection, prompt injection protection and deepfake awareness.
Public funding does not replace cyber strategy, but it can accelerate implementation. KPO, FBiO, Digital Europe, SME grants, programmes for local governments, water utilities, hospitals and critical infrastructure create demand for projects that might otherwise be delayed.
Do not write a project for a purchase. Write it for a risk, critical service and measurable outcome. Only then choose technology and provider.
A cyber budget should not be a percentage of IT spend without connection to risk. It should result from which systems and processes are critical and what their unavailability would cost.
First determine what can stop the company. Only then choose tools.
MFA, backup, EDR, updates, training, incident response and supplier assessment often deliver more value than an expensive platform without operation.
A tool without an administrator, monitoring, procedure and updates quickly loses value.
Backup, incident procedure and crisis communication must be tested. Without testing, the organization has a declaration, not resilience.
Do not measure only purchased licences. Measure detection time, response time, closed gaps, restore results and number of assessed suppliers.
The provider should understand the client’s sector. Hospital cybersecurity differs from water utilities, manufacturing, finance and e-commerce.
A cyber provider can be an attack vector. The customer should require MFA, access controls, incident procedures, action logging and provider security evidence.
Sales is one thing. The key is who will implement, who will maintain, who will answer an alert after hours and who will respond during an incident.
A good provider does not report only alerts. It reports risk, impact, gaps, actions, SLA and decisions required from the customer.
The customer should know what happens to logs, accounts, configuration, documentation and data after cooperation ends.
The company hears about a growing market and regulation, then buys the first fashionable tool. This is not a strategy.
Even the best provider cannot replace the risk owner, board decisions and customer-side accountability.
SIEM, EDR, backup or PAM require configuration, operation, updates and response. Without maintenance, they become a dead cost.
The company has backup, but never checked whether a critical system can be restored within a business-acceptable time.
After implementation, reports, protocols, access reviews, risk register and documents needed for audit or customer questionnaires are missing.
The project is delivered, but there is no money for licences, monitoring, training and reviews. Resilience drops after a few months.
The customer does not buy a dashboard. It buys lower risk, audit readiness, shorter response time and stronger business continuity.
NIS2, national cybersecurity rules, DORA and CRA are not marketing slogans. They require specific processes, evidence and reporting.
Sales is easier than delivering a project, especially with many customers, short deadlines and shortage of specialists.
A cyber provider must be well protected itself. Otherwise, it becomes a risk for customers.
The market is shifting toward services and maintenance. A provider based only on one-off deployments may lose advantage.
A mid-sized services company sees growing customer requirements and hears about NIS2. The board wants to quickly buy “something for cyber”, but the CFO asks what the outcome will be and whether the cost makes sense. IT proposes EDR and backup. Compliance points to the need for a risk register and procedures. Sales says customers started sending security questionnaires.
The company decides on a staged programme. First it performs applicability assessment, maps critical systems, implements MFA, performs restore testing, prepares an incident response plan and runs phishing training. Then it implements managed EDR, supplier assessment, monitoring and board reporting. After three months, the company has not only tools, but also evidence: MFA report, restore test, risk register, incident plan, training report and remediation list.
The provider that won the project did not sell the cheapest licence. It proposed a resilience plan, maintenance, evidence and reporting. That is why the growing cybersecurity market will reward those who can deliver capability, not only a product.
This topic can be connected with further reading and CCyber services to move from market observation to a practical action plan.
ccyber.io helps companies and institutions use the growing cybersecurity market practically: without random purchases, fake compliance or tools no one maintains. We help plan cyber as a resilience, compliance and business continuity programme.
We can support your organization with:
The best first step is a Cyber Budget and Resilience Workshop. In a short workshop, the organization can determine which risks matter most, which expenses make sense, what can be funded, how to choose a provider and how to measure real cyber resilience improvement.
Not automatically. Budget should follow risk, regulation, critical services, downtime cost and organizational maturity. Sometimes better use of current tools matters more than buying new ones.
The key drivers are increasing incident numbers, NIS2 and national cybersecurity rules, cloud and SaaS, customer requirements, cyber insurance, public funding and stronger board awareness.
It is worth considering when the organization has no internal monitoring and response capability. Scope, log sources, SLA, escalation, reporting and customer-side responsibilities must be clearly defined.
No. NIS2 requires processes, risk management, incident reporting, employee training, supplier assessment, board oversight and evidence. Tools help, but they do not replace a management system.
Check sector experience, delivery quality, own security, maintenance model, SLA, board reporting, post-implementation evidence and exit plan.
Probably both. It can automate analysis and detection, but it also creates new risks such as shadow AI, deepfake, AI-generated phishing and data leaks.
Yes, selected programmes may fund part of cyber projects. However, the problem, scope, budget, outcomes and evidence still need to be well described. Funding does not replace strategy.
Start with critical services, downtime cost, baseline safeguards, suppliers, regulatory requirements and backup testing. Then choose tools and providers.
The cybersecurity market in Poland is growing because companies and institutions depend more heavily on digital systems, while threats, regulations and customer requirements continue to increase. Cybersecurity is no longer an IT purchase. It is part of risk management, business continuity and board accountability.
For customers, this means spending money wisely: risk, processes, owners, evidence and maintenance first, then tools. For providers, this means an opportunity for growth, but only with delivery quality, recurring services, regulatory understanding and strong own security.
The best rule is: do not treat the growing cyber market as a signal to buy everything. Treat it as a signal that digital resilience is becoming a normal cost of operating a modern organization and must be planned as seriously as finance, operations and sales.
75% Funding for SME Cyber Resilience: How to Prepare a Digital Europe Project?
Funding of up to 75% of cybersecurity project costs for SMEs is a major opportunity, but only for organizations that can clearly describe the problem, beneficiary, outcome, budget, risks and delivery evidence. Programmes such as Digital Europe do not fund random tool purchases. They fund projects that help SMEs increase cyber resilience, implement CRA and NIS2, use cyber toolkit as a service, develop response services, training, hotlines, risk assessment automation, SaaS integrations and AI-based cybersecurity tools. The key conclusion: the project should start with real risk and measurable impact, not a licence list.
Prepared by: CCyber Editorial Team
Note: This article is educational and strategic. It is not legal, tax or grant advisory advice. Every call must be checked against the current competition documentation.
Cyber resilience funding for SMEs can cover a very significant part of project costs, but only when the project is well designed and aligned with the call objective. In the DIGITAL-ECCC-2025-DEPLOY-CYBER-09-UPTAKE call, support of up to 75% of costs for SMEs and up to 50% for other entities was indicated for projects focused on uptake of innovative cybersecurity solutions for small and medium-sized companies. This is not a grant for any hardware or licence purchase. The best project should help SMEs manage risk, identify assets, assess vulnerabilities, support incident reporting, integrate with SaaS tools, train employees, support NIS2 and CRA compliance and reduce incident response time. The key is a clear problem, measurable outcome, strong team, realistic budget, delivery evidence and sustainability plan after funding ends.
July 2026
The Digital Europe calls from the DIGITAL-ECCC-2025-DEPLOY-CYBER-09 series had a defined application deadline and, according to ECCC information, are now closed. This does not reduce their value for companies planning future projects. Such calls show which types of cybersecurity projects are currently prioritized in the EU and how scope, budget, consortium and outcomes should be prepared.
This article should therefore be read in two layers. The first is a practical explanation of UPTAKE and CYBERAI. The second is guidance on how to prepare for future similar calls, because many EU requirements, evaluation logic and project expectations repeat across funding rounds.
Funding of up to 75% for SMEs means that a company or consortium may obtain coverage of a significant part of eligible project costs. This is a major advantage compared with many programmes where the standard support rate is lower.
However, this does not mean the project is cheap or simple. The applicant still needs own contribution, cash flow, team, documentation, reporting, risk management, delivery evidence and post-project sustainability.
UPTAKE was focused on the uptake of innovative cybersecurity solutions for SMEs. Its purpose was not for every company to buy a separate tool. It was about developing practical solutions that help small and medium-sized companies manage security daily.
SMEs often do not have a large IT department, internal CISO, SOC, GRC, compliance team or enterprise budget. They need solutions that are easy to use but technologically mature. Solutions that help diagnose risk, prioritize actions, report incidents, integrate with SaaS and prepare compliance evidence.
Cyber toolkit as a service is a practical set of services and tools helping SMEs perform basic cybersecurity actions without building a full security department. A good cyber toolkit is not only a dashboard with reports. It should guide the company from diagnosis to action.
The best SME projects solve a scale problem. A single small company will not build its own SOC, but it can use a service. It will not hire a full GRC team, but it can use a tool and consultation. It may not have a NIS2 expert, but it can have a compliance workflow, checklists, evidence repository and vCISO support.
CYBERAI focused on cybersecurity based on artificial intelligence. In practice, this means solutions where AI is not a marketing addition, but a real mechanism improving detection, analysis, automation, response or resilience.
For SMEs, AI can simplify cybersecurity because it helps analyze alerts, explain risk, generate recommendations and support first response. At the same time, it can increase risk if the company enters confidential data into public AI tools, trusts automated recommendations without verification or uses models without supplier control.
Startup Platforms support individuals and teams that want to develop an innovative business idea in Eastern Poland with experts and business mentors. The programme helps prepare an MVP, validate the business model and establish a company. After incubation, the best startups may apply for non-repayable funding of up to PLN 600,000.
Ścieżka SMART supports research, development and innovation projects. It can make sense for cyber companies that do not only want to implement an existing solution, but develop a new product, technology, algorithm, detection method, AI tool or business process with at least national-level innovation.
Not every cyber project should go to the same programme. The right path depends on whether the company wants to implement security internally, build a product for SMEs, develop AI technology, build a startup or perform R&D work.
A good direction is UPTAKE-type calls if the project delivers a practical solution for SMEs, helps with CRA and NIS2, integrates tools, trains users and supports incident handling.
A good direction is CYBERAI-type calls if AI is the core of the solution and genuinely supports detection, response, data analysis, CTI, automation or AI protection.
A good direction is Startup Platforms if the team is building an MVP, business model and early market validation.
A good direction is Ścieżka SMART or similar FENG instruments if the project requires R&D and has potential for product or process innovation.
A national, regional, digitalisation loan, FBiO, sector project or commercial cyber package may fit better, depending on the sector and company status.
The project should not start with “we will buy a platform”. It should start with a problem: SMEs lack asset visibility, do not know how to report incidents, cannot assess suppliers, have no compliance evidence, do not understand CRA or are vulnerable to phishing.
SME is too broad. A better description is: small manufacturing companies with OT, accounting firms, clinics, software houses, e-commerce stores, municipal companies, logistics companies, SaaS providers or SMEs indirectly affected by NIS2 through enterprise customers.
The outcome should be specific: platform, service, hotline, training modules, pilot, deployment in a defined number of SMEs, effectiveness report, SaaS integrations, risk assessment module or incident reporting tool.
The project must show how the solution will work in practice. Who onboards SMEs? How is data collected? How is confidentiality protected? Who responds to a report? What happens after a risk is detected? What does the report for the business owner look like?
It is not enough to write “we will improve cybersecurity”. Metrics are needed. How many companies will use the tool? How many risk assessments will be performed? How many vulnerabilities will be found? How many people will be trained? What will be the response time to reports?
A grant must be reported. Already at application stage, you should know which evidence will confirm delivery: reports, protocols, logs, test results, participant lists, code repository, technical documentation and pilot reports.
Every call has its own eligibility rules, so the list below is a practical starting point, not a universal guarantee. In projects such as UPTAKE, costs directly linked to building, deploying and validating a solution for SMEs make sense.
A good budget follows work packages. It should not be a wish list. Each cost should have justification, owner and connection to project outcome.
In Digital Europe projects, a consortium is often recommended because the project requires a combination of technology, research, deployment, sector and operational skills. A consortium may, however, slow the project if partner roles are unclear.
KPIs should show that the project genuinely improves SME cyber resilience. They should not measure only the number of meetings or prepared slides.
Grant projects most often fail not because technical work is missing, but because evidence is missing. In cybersecurity, evidence is especially important because it shows that the solution not only exists, but works and increases resilience.
“We will improve SME cybersecurity” is too weak. You must show which SMEs, what risks, what tools, what outcomes and what evidence.
Adding AI to the project does not automatically improve chances. You must show how AI works, which data it processes, how it is tested and how errors are limited.
A project for all SMEs is often a project for nobody. A project for a specific sector, problem or process is stronger.
Costs must follow work packages. Evaluators will quickly see whether the budget is realistic or only a shopping list.
Evaluators want to know what happens after funding ends. Who will maintain the platform? Who will pay for infrastructure? Will SMEs continue using it?
A cyber project needs technical, security, UX, regulatory, project management and grant reporting competence. The idea alone is not enough.
The project has many authors, but nobody controls timeline, budget, partners, risks and evidence.
Evidence collected at the last minute is incomplete, inconsistent and difficult to defend.
The team tries to build everything at once. It is better to deliver a smaller but working module that can be tested with SMEs.
A cyber project with security gaps loses credibility. Tests should be part of the timeline and budget.
The platform may be technically good, but if SMEs do not understand its value or onboarding is too difficult, the project will not achieve impact.
The project ends with a report, but nobody owns sales, maintenance and product development after the grant.
The best SME cyber project should connect with real regulatory obligations. NIS2 concerns risk management, incidents, business continuity, suppliers, training and management accountability. CRA concerns cybersecurity of products with digital elements. A project may support both areas, but it must clearly show which problem it solves.
A tool without owner, procedure and maintenance quickly becomes a cost, not resilience improvement.
A project with clear scope that delivers impact is better than a project promising a complete cyber revolution without a realistic plan.
If the solution is for SMEs, it must be tested with SMEs. Otherwise, it is easy to build a platform small companies will not use.
The grant ends, but the product, service, hotline, platform and data must be maintained. The post-project model is as important as the start.
Reports, protocols, logs, tests, participant lists and pilot results should be created during the project, not after it.
A Polish SaaS company provides accounting workflow software for SMEs. Its customers increasingly ask about NIS2, CRA, backup, MFA, cyber insurance and supplier security. The company considers a UPTAKE-style project: it wants to build a cyber toolkit as a service module for its customers.
The first concept says: “we will add a cybersecurity panel”. This is not enough. After a workshop, the project is refined. The module maps SaaS assets, checks MFA configuration, detects basic supplier risks, provides an NIS2 checklist for SMEs, enables incident reporting, delivers phishing training and generates a report for the business owner.
The project has a pilot with 100 SMEs, effectiveness metrics, integrations with accounting and CRM systems, security tests, evidence repository and commercialization plan. It is no longer only a “cyber add-on to a product”, but a real service improving customer cyber resilience and supporting regulatory requirements.
This topic can be connected with further reading and CCyber services to move from a funding idea to a well-prepared project, application and implementation.
ccyber.io helps companies, SMEs, startups, SaaS providers and consortia prepare cybersecurity projects for Digital Europe, FENG, Startup Platforms, Ścieżka SMART and other funding instruments. We combine cybersecurity, AI, regulation, product, budget, evidence and project delivery perspectives.
We can support your organization with:
The best first step is a Cyber Grant Readiness Workshop. In a short workshop, the company can check whether the idea fits the funding programme, which outcomes should be planned, which costs are logical, whether a consortium is needed and which evidence should be collected from the first day of the project.
In simplified terms yes, but only for eligible costs and subject to the call rules. Own contribution, cash flow, non-eligible costs, reporting and post-project maintenance must also be considered.
No. At the time of writing, the DIGITAL-ECCC-2025-DEPLOY-CYBER-09 calls are closed. Their description remains a strong model for future cybersecurity projects and calls.
Usually not. A purchase must be part of a project with objective, outcome, beneficiary, deployment, tests, evidence and maintenance plan.
No. Depending on call rules, SMEs, public and private entities, universities and research organizations may participate. Alignment with objective and beneficiaries is what matters.
It can, but only when AI solves a specific problem. AI without data, validation, security controls and AI Act compliance may weaken the project.
They are a different path. Startup Platforms are good for teams at idea and MVP stage. Digital Europe is more suitable for deployment projects, consortia and solutions with broader impact.
Yes, if the project has a real R&D component and develops an innovative product or process. It is not the best fit for simple purchases of existing tools.
Start with the problem and beneficiary. Then describe outcome, KPIs, architecture, budget, team, risks, evidence and post-funding maintenance plan.
Funding of up to 75% for SME cyber resilience is one of the most attractive paths for cyber project financing, but only for well-prepared organizations. Such programmes do not fund random purchases. They fund solutions that help SMEs genuinely improve security, manage risk, meet CRA and NIS2 requirements, respond to incidents and build sustainable skills.
UPTAKE shows the direction for cyber toolkit as a service, SaaS integrations, risk assessment, incident reporting and SME support. CYBERAI shows the direction for AI-based tools, but requires a mature approach to data, model security and regulatory compliance. Startup Platforms and Ścieżka SMART are important alternatives for startups and R&D projects.
The best rule is: do not write the project for the call. Write the project for a problem SMEs truly have, and treat funding as a way to solve that problem faster, better and with evidence.
Cybersecurity on the Warsaw Stock Exchange: How NIS2, KPO and FBiO Create Demand for IT Companies
NIS2, national cybersecurity rules, KPO, FBiO and the growing number of cyberattacks are creating a new wave of demand for cybersecurity services in Poland. For IT companies, integrators, cloud providers, managed services, SOC, MDR, consulting, training, audits, backup, IAM, EDR, SIEM and OT security providers, this may mean more projects, tenders and long-term services. However, not every IT company will automatically benefit from regulation. The biggest advantage will belong to companies that can deliver compliance, implementation, evidence, maintenance and real risk reduction. For customers, the key conclusion is simple: cyber budgets should not go into random purchases, but into resilience that works during an incident.
Prepared by: CCyber Editorial Team
Note: This article is educational and strategic. It is not investment advice, brokerage advice or a recommendation to buy or sell shares of any company.
Cybersecurity has become a stock market topic because regulation, public funding and real threats create demand for IT and security projects. NIS2 and national cybersecurity rules require many organizations to implement risk management, ISMS, incident procedures, backup, MFA, supplier assessment, monitoring and training. KPO, FBiO, the Digital Europe Programme and other funding instruments provide money for digitalisation, security and resilience. For IT companies, integrators, managed service providers, cloud providers, SOC, MDR, IAM, EDR, backup, SIEM, OT security and consulting providers, this may create market growth. However, this does not mean that every IT company will automatically win. The biggest beneficiaries will be providers that understand regulation, can deliver projects in critical sectors, have delivery capabilities, maintain services and provide compliance evidence.
July 2026
For many years, cybersecurity was seen as an IT department cost. Today it is becoming part of business strategy, compliance, financing, reputation and operational resilience. This changes how boards, investors, auditors, insurers and enterprise customers view it.
On the public market, this creates a simple mechanism: the more organizations must implement cybersecurity, the greater the demand for companies that can design, deliver and maintain such projects. This is why NIS2, national cybersecurity rules, KPO and FBiO matter not only for regulated entities, but also for IT and cyber service providers.
NIS2 does not tell companies to buy a specific product. It says: manage risk, secure systems, report significant incidents, oversee suppliers, train people, measure effectiveness and involve management. This means demand includes not only tools, but entire cyber transformation programmes.
Regulation creates the obligation, but funding enables delivery. KPO, FBiO, Digital Europe, NCC-PL grants and digitalisation loans help organizations finance investments that may previously have been postponed.
For IT providers, this means more tenders, requests, consulting projects, deployments, training and maintenance services. For customers, it means the need to prepare scope carefully, because funding should not lead to random purchases.
This is not only about classic cyber companies. The cybersecurity market has many layers. Some revenue will go to consulting firms, some to integrators, some to software providers, some to managed service providers and some to companies operating infrastructure, cloud, data centres and OT.
Regulations increase demand, but they do not guarantee success for every provider. Customers will increasingly ask not only about the product, but about sector experience, implementation quality, references, the provider’s own security, SLA, documentation, evidence, maintenance and accountability.
Companies must check whether they are in scope, what gaps they have and how to prepare evidence. This creates demand for consulting, audits, gap assessment, documentation, ISMS and board reporting.
Many organizations will not build their own SOC. They will look for monitoring, alert handling, incident response and monthly reporting services. This segment may be attractive because it generates recurring revenue.
Ransomware makes backup, restore testing, DRP and BCP a board priority. This concerns companies, hospitals, local governments, water utilities, manufacturing and logistics.
Identity is one of the first implementation areas. MFA, access reviews, privileged accounts, supplier accounts and secure remote access will appear in most NIS2 projects.
Manufacturing, energy, water utilities, transport and industry need OT protection. This segment is harder than classic IT, but has high advisory and implementation value.
NIS2 and national rules require training and digital hygiene. Demand will cover employees, boards, IT, OT, finance, HR and incident response owners.
Organizations will need to prove that safeguards work. This creates demand for penetration testing, technical audits, supplier assessments, tabletop exercises, reports and evidence repositories.
A cyber budget should not be spent under fear or regulatory pressure. The worst scenario is buying many tools that nobody operates, integrates or measures. A good cyber purchase starts with risk, not a sales offer.
Customers no longer need only a provider of hardware, licences or configuration. They need a partner that understands risk, regulation, processes, people and evidence. An IT provider that wants to benefit from rising demand must be able to speak the language of the board, compliance and operations.
From a market perspective, it is important to distinguish between a one-off project and recurring service. MFA deployment, audit or gap assessment can be one-off. Monitoring, SOC, MDR, vulnerability management, backup as a service, vCISO and recurring reporting can create stable revenue.
For customers, this means cyber cost does not end with implementation. For providers, it means the most valuable business model may be tied to maintaining security capability, not only selling licences once.
Market growth does not remove risk. Providers may face shortages of specialists, delivery quality issues, margin pressure, long tender cycles, contractual liability, risk of their own incident and underestimated cost of maintaining services.
Customers can waste significant money if they treat NIS2 as a procurement race. The worst model is buying tools, postponing documentation, assigning no owners and not testing operation.
A good cyber budget should be connected with risk, regulation, critical services and downtime cost. It should not copy a supplier’s tool list.
A provider that knows healthcare, water utilities, manufacturing, finance or public administration will understand real risks, systems and constraints faster.
A security provider should itself have MFA, access control, incident procedures, backup, audits and appropriate safeguards. A cyber provider can also be an attack target.
The key question is: who will actually implement the project, who will maintain it and what experience do they have?
The provider should report not only alert counts, but risk, impact, decisions, SLA, gaps and remediation actions.
The customer should know what happens to logs, configuration, documentation, accounts and data after cooperation ends.
Just because the market grows does not mean every IT company will improve results. Margins, skills, delivery, people costs, customer retention and service quality matter.
The customer hears about NIS2 and buys the first tool instead of starting with risk, critical services and formal requirements.
Implementation without maintenance budget quickly loses value. Cybersecurity requires continuous work, not a one-time purchase.
The board needs information about risk, impact, costs and decisions. A report about alerts and vulnerability counts is not enough.
Public projects can be large, but they have long procedures, formal requirements, documentation, budget constraints and high evidence expectations.
An IT or cyber provider can be an attack vector. The customer should assess the provider like any other critical supply chain risk.
A mid-sized manufacturing company learns that it may fall under national cybersecurity rules and NIS2. The board wants to “buy compliance”, but does not know where to start. It receives three offers: one for a SIEM tool, one for documentation and one for a full programme with audit, MFA, backup, incident procedure, supplier assessment, training, monitoring and board reporting.
The cheapest offer looks attractive, but does not solve the problem. A tool without people does not create readiness. Documentation without tests does not stop ransomware. The company chooses a staged model: first applicability assessment, risks, MFA, backup and incident response, then monitoring, suppliers and tabletop. The budget is phased and outcomes are measurable.
The provider that won the project did not sell only licences. It sold a capability: implementation, evidence, maintenance, reports and recurring review. This is the mechanism through which regulation and funding can create a durable market for mature IT companies.
This topic can be connected with further reading and CCyber services to move from market observation to a practical action plan.
ccyber.io helps companies and institutions translate NIS2, national cybersecurity rules, KPO and FBiO into practical cybersecurity projects. We also help IT providers organize their cyber offer so it addresses real customer needs, not only regulatory slogans.
We can support your organization with:
The best first step is a NIS2 and Cyber Funding Strategy Workshop. In a short workshop, the organization can determine which obligations apply, which budgets are needed, which actions may be funded and how to select providers that deliver real resilience.
No. NIS2 increases demand, but provider results depend on skills, margins, delivery quality, maintenance model, sector experience and ability to scale services.
Yes, selected KPO and FBiO instruments cover digitalisation, security, cybersecurity and resilience. However, every project must be checked against eligibility, programme objectives and financing rules.
Not always. First, the customer should understand risks, critical systems, backup status, MFA, suppliers and procedures. Then it makes sense to select tools.
Applicability assessment, gap assessment, ISMS, MFA, backup, EDR, SOC/MDR, supplier assessment, training, incident response, tabletop, audit and evidence repository.
Yes. Many organizations do not have 24/7 security teams, so monitoring, MDR, managed EDR, managed backup, vCISO and vulnerability management may become long-term needs.
Yes. The provider may have access to customer systems, logs, administrator accounts and data. The customer should require MFA, access controls, incident procedures, action logging and provider security evidence.
No. The article describes cybersecurity market mechanisms and regulatory demand. It is not a recommendation to buy, sell or hold shares of any company.
Start with applicability assessment, critical services, risks, MFA, backup, suppliers, incident procedure and maintenance budget. Then select specific tools and providers.
NIS2, national cybersecurity rules, KPO and FBiO create a strong demand impulse for the Polish cybersecurity market. For IT companies, integrators, managed service providers, cloud providers, SOC, MDR, IAM, EDR, backup, SIEM, OT security and consulting firms, this means an opportunity for more projects and recurring services.
However, this is not an automatic boom for every provider. The market will reward those that combine regulation with practical implementation, technology with process, project with maintenance and technical reporting with customer board decisions.
The best rule is: do not look at cybersecurity only as a regulatory cost or stock market trend. Look at it as a capability that must work when an incident, audit, customer question or real business downtime appears.
NIS2 in the Food Industry: Will Cybersecurity Costs Increase Food Prices?
The food industry was not included in NIS2 and national cybersecurity rules by accident. Modern food production depends on ERP, MES, WMS, cold storage, quality systems, logistics, invoicing, OT, automation and digital suppliers. A cyberattack can stop production, disrupt the cold chain, delay deliveries, weaken batch traceability, block warehouses or force manual work. Implementing NIS2 and national cybersecurity rules means costs for food producers: risk management, ISMS, MFA, backup, monitoring, segmentation, supplier assessment, training, incident response and audits. Some costs may end up in product prices, but the cost of low resilience can be higher: downtime, lost batches, penalties, lost contracts and supply disruption.
Prepared by: CCyber Editorial Team
Yes, cybersecurity costs in the food industry may indirectly affect food prices, especially among large producers, processors and wholesale distributors covered by national cybersecurity rules and NIS2. This does not mean that cybersecurity is an unnecessary regulatory cost. Food production is now dependent on IT, OT, automation, cold chain, warehouses, invoicing, quality systems, logistics, suppliers and data. A cyberattack may stop a plant, delay deliveries, disrupt production, block traceability, affect warehouses or force manual work. Implementing national cybersecurity rules and NIS2 means costs for risk management, ISMS, MFA, backup, monitoring, segmentation, supplier assessment, training, incident response and audits. Some of these costs may be passed through to contracts, price lists or consumers. However, the cost of a successful attack can be higher than the cost of well-planned resilience.
July 2026
Food is a basic element of economic and social security. A large producer, processor, wholesale distributor, cold storage operator or supplier to retail chains does not operate only through machines and people. It operates through digital systems.
A modern food plant uses ERP, MES, WMS, production planning systems, automation, quality control systems, refrigeration systems, laboratory systems, electronic data exchange with customers, invoicing, transport, labelling, traceability and supplier communication.
It can, but not in a simple way. Cybersecurity is a cost of operating a modern plant. Companies must pay for people, tools, audits, training, backup, monitoring, segmentation, documentation, suppliers, tests and maintenance of safeguards. In a low-margin sector, part of these costs may be passed on to contracts, price lists, service fees or ultimately consumers.
However, the question should be reversed. What does low cybersecurity cost when the plant cannot produce for several days, cannot invoice, has no access to quality documentation, loses data, suffers cold storage downtime or cannot ship goods to a retail chain?
The cost of compliance is visible because it appears in the budget. The cost of an incident is often underestimated because the organization sees it only after an attack. This is one of the reasons why boards sometimes see cybersecurity as a cost rather than insurance for business continuity.
Every company involved in food production, processing or distribution should analyze its status. This especially applies to medium-sized and large companies, wholesale distributors, industrial producers, large processors, cold storage operators and suppliers to retail chains.
Even a smaller company may feel NIS2 impact if it supplies a regulated entity. A large producer, retail chain or distributor may require MFA, backup, incident procedure, training evidence, supplier assessment, audit or cyber insurance from its suppliers.
The key obligations are not limited to one document. The company should build an operating cyber risk management system covering people, processes, technology, production, OT and suppliers.
NIS2 preparation should start with a map of systems affecting production and deliveries. Not all of them are typical IT. Some are OT, automation or intermediate systems between production and office.
ERP stops working. The company cannot issue warehouse documents, invoices, production orders and shipping documents. Production may continue for a short time, but data, orders and confirmations quickly become unavailable.
The warehouse does not know where product batches are, what expiration dates apply, which orders must be shipped and which documents are needed. Manual work slows deliveries, increases errors and can affect retail chains.
A temperature monitoring system or cold storage automation stops working or the data becomes unreliable. The company must assess whether batches still meet quality requirements and whether they can be shipped to customers.
A supplier has remote access to the plant systems. Its account is compromised or its service tool becomes the attack vector. The company does not control who connected to the environment and when.
The company loses access to batch traceability data. In case of a quality issue, it cannot quickly determine where the product went and which batches should be blocked or recalled.
Food plants increasingly use automation, robotics, sensors, industrial IoT, dosing systems, refrigeration, packaging machines and digitally managed production lines. This improves efficiency, but creates OT risks.
OT is not secured in the same way as office laptops. Production continuity, physical safety, maintenance windows, automation supplier responsibility and product quality impact must be considered.
The board does not need to configure firewalls. It must understand risk, approve priorities and require evidence. National cybersecurity rules and NIS2 move cybersecurity from IT level to organizational accountability.
The company should check sector, size, group structure, activity type and customer relationships. In corporate groups, it must be clear which companies and plants are in scope.
Do not start with tools. Start with the process: order, production, quality control, cold storage, warehouse, shipping, invoicing, traceability, complaints and batch recall.
Risks must be described in business language. Example: WMS unavailability blocks shipments to a retail chain, which triggers contractual penalties and shelf-space risk.
MFA, EDR, backup, restore testing, updates, segmentation, monitoring, email protection and remote access control should be treated as the operational minimum.
Every obligation should have evidence: MFA report, backup report, restore test, access review, supplier assessment, training report, incident register, tabletop report and board decision.
Documents are needed, but not enough. If the company has no backup, MFA, supplier control and manual work plan, documentation will not stop downtime.
The IT team secures email and laptops, but does not analyze production lines, automation, cold storage, SCADA and service access.
The board sees implementation cost, but does not know the cost of one day of production downtime, lost batches or delayed deliveries to retail chains.
The company says it has backups, but has never restored ERP, WMS, MES or quality documentation in a realistic scenario.
Automation and IT suppliers have system access, but there is no MFA, named accounts, logging or periodic access review.
Incident response is written for IT, but does not say what production, warehouse, quality, logistics and the board should do.
Training covers office staff, but not production, warehouse, maintenance and automation teams.
The cheapest compliance often ends with documents without operation. It is better to implement fewer elements that truly reduce risk.
Not every cyber expense must automatically increase unit product cost. A well-planned programme can reduce cost through prioritization, shared purchasing, standardization, automation and eliminating fake compliance.
A medium-sized food producer has two plants, ERP, WMS, quality system, laboratory, cold storage, packaging lines, several automation suppliers and an external IT provider. The analysis shows that the company is likely to fall under national cybersecurity rules as an important entity. The board is concerned about costs because margins are low and retail chains negotiate prices strongly.
The first review shows partial MFA, backup without current testing, no IT/OT segmentation, incomplete remote supplier list, no formal incident procedure and no board reporting. At the same time, the cost of one day of production downtime is several times higher than the cost of implementing a baseline cyber programme.
The company implements a 90-day plan: applicability assessment, risk register, MFA for critical accounts, restore test for ERP and WMS, assessment of automation suppliers, ransomware playbook, training for production and warehouse staff, and IT/OT segmentation review. After three months, the board sees not only a list of costs, but also concrete risk reduction: shorter recovery time, supplier control and incident readiness. The cybersecurity discussion moves from “regulatory cost” to “cost of maintaining supply”.
This topic can be connected with further reading and CCyber services to move from cost concerns to a practical compliance and resilience plan.
ccyber.io helps food companies translate national cybersecurity rules and NIS2 into a practical cyber resilience programme that covers production, OT, logistics, quality, suppliers and costs. This is not only about documentation. It is about maintaining production, deliveries and customer trust despite growing threats.
We can support your organization with:
The best first step is a Food Sector NIS2 Readiness Workshop. In a short workshop, the company can determine whether it is in scope of national cybersecurity rules and NIS2, which processes are critical, where the biggest gaps are, how much downtime can cost and which actions reduce risk most without overloading the budget.
Not automatically. Sector, company size, role in the supply chain, group structure and national law must be checked. Even a company not directly in scope may receive requirements from customers.
Yes. Under Polish national cybersecurity rules, food production, processing and distribution are listed among important sectors.
They may partly affect prices, especially where margins are low and implementation costs are high. However, this is not only regulatory cost. It is an investment in production and supply continuity.
Applicability assessment, critical system map, risk register, MFA, backup, restore test, supplier assessment, incident response and basic training.
No. Documentation must be supported by operating evidence: MFA reports, restore tests, access reviews, supplier assessments, training, incident procedures and board reporting.
Yes. OT in a food plant requires separate analysis because it includes production lines, automation, cold storage, SCADA, PLCs and supplier service access.
Yes, especially if they supply large producers, retail chains, wholesalers or entities covered by NIS2. Requirements may appear in contracts and security questionnaires.
Start with the highest-impact risks, use existing tools, combine NIS2 with ISO 27001 and customer requirements, standardize across plants and measure outcomes.
NIS2 and national cybersecurity rules in the food industry are not a legislative curiosity. Food production, processing and distribution now depend on digital systems, suppliers, automation, data and supply chains. A cyberattack can quickly affect production, logistics, store shelves and consumer costs.
Implementation costs may be significant, but the cost of low resilience can be higher: downtime, lost batches, supply chaos, contractual penalties, lost customers and economic security risk. This is why implementation should be proportionate, practical and measurable.
The best rule is: do not ask only how much NIS2 costs. Ask how much one day without production, warehouse, cold storage, ERP, WMS, traceability and customer deliveries costs. Only then does cybersecurity become part of the resilience calculation, not only a regulatory cost.
Cybersecurity of Hospitals and Healthcare Providers: EU Action Plan, NIS2 and Practical Steps
The European action plan on the cybersecurity of hospitals and healthcare providers shows that healthcare is one of the most sensitive digital sectors. A cyberattack on a hospital is not only an IT problem. It can mean delayed procedures, unavailable medical records, emergency room disruption, patient data loss, diagnostic delays or operational chaos for medical staff. The EU plan focuses on four pillars: prevention, detection, response and recovery, and deterrence. For healthcare providers, this means implementing an ISMS, risk assessment, MFA, backup, segmentation, medical device security, monitoring, incident procedures, supplier assessment, training and readiness to report incidents under NIS2 and national cybersecurity rules.
Prepared by: CCyber Editorial Team
Cybersecurity of hospitals and healthcare providers is directly connected with patient safety. Ransomware, data leakage, unavailable electronic medical records, administrator account takeover, an attack on a diagnostic supplier or loss of access to medical records can affect treatment, diagnostics, emergency departments, planned procedures and patient trust. The European action plan for cybersecurity of hospitals and healthcare providers defines four pillars: prevention, detection, response and recovery, and deterrence. For healthcare providers in Poland, this means connecting the EU plan with NIS2, national cybersecurity rules, GDPR, EHDS, AI Act, cyber insurance and daily risk management. The key actions are: risk register, ISMS, backup and restore testing, MFA, EDR, segmentation, medical device control, monitoring, incident procedures, supplier assessment, staff training and board reporting.
July 2026
Digitalisation of healthcare has accelerated. Electronic health records, e-prescriptions, telemedicine, AI-supported diagnostics, connected devices, imaging systems, laboratories, patient portals and cloud improve care efficiency, but also expand the attack surface.
A hospital is now a digital organization. Doctors, nurses, reception, laboratories, imaging, hospital pharmacy, administration and external providers rely on IT systems. When these systems stop working, the problem is not only technical. It can delay treatment, force staff to work on paper, limit access to results and disrupt patient flow.
Prevention means building cybersecurity foundations before an incident happens. In practice, this includes critical security practices, risk management, guidance, training, procurement with cyber requirements, digital hygiene and financial support for smaller providers.
Detection means the ability to notice an attack early, before full disruption occurs. The EU plan foresees an EU-wide early warning service for the health sector and better sharing of threat information.
Response and recovery mean preparing for the worst scenario: ransomware, data leakage, unavailable EHR system, supplier failure or attack on medical devices. The EU plan refers to rapid response, the EU Cybersecurity Reserve, exercises and playbooks for the health sector.
Deterrence concerns actions at state and EU level. The goal is to show attackers that attacks against healthcare systems are met with coordinated diplomatic, legal and operational response.
The EU plan proposes a European Cybersecurity Support Centre for hospitals and healthcare providers. It is intended to operate with ENISA and provide practical support to the sector: guidance, tools, services, training, playbooks and early warning.
For a healthcare provider, the key is readiness to use such support. The existence of a support centre will not replace a local incident plan, backup, MFA and system owners.
In a company, system downtime often means lost sales or delayed work. In a hospital, downtime can delay diagnostics, a procedure, discharge, admission or access to test results. This changes the weight of decisions.
HIS, EHR, PACS, RIS, LIS, pharmacy, operating theatre system, emergency department, medical devices, finance system, HR, email, registration, patient portal and supplier systems create a complex ecosystem.
Some medical devices operate for many years, have limited update options, require certification, depend on specialist service and cannot easily be shut down for patching.
A hospital operates 24/7. Doctors and nurses cannot stop working only because a security measure is inconvenient. Safeguards must be designed to protect without blocking care.
Providers of medical, diagnostic, laboratory, cloud and service systems often have remote access, and their incident can affect the healthcare provider.
The EU plan sets the direction. NIS2 and national rules create obligations. A healthcare provider should connect both levels into one cyber resilience programme.
Not everything can be secured at once. Start with critical services and dependencies. In healthcare, criticality is not only technical. It depends on patient impact.
Ransomware is one of the key threats for healthcare. Backup must therefore be designed not as an archive, but as part of maintaining continuity of care.
Account takeover is one of the easiest ways into a healthcare provider. In healthcare, the challenge is harder because staff rotate, work shifts, use shared workstations and often need fast access to systems.
MFA must not block care in emergencies. This is why exceptions, emergency accounts, break glass procedures, logging of their use and review after each use are needed.
Medical devices and Internet of Medical Things are among the hardest areas of hospital cybersecurity. Some devices communicate with the network, some send data to clinical systems, some require supplier service and some operate on older operating systems.
A hospital does not operate alone. Many key processes depend on suppliers: HIS, EHR, PACS, RIS, LIS, diagnostics, outsourced IT, cloud, medical device service, laboratories, external companies and healthcare service providers.
A healthcare provider does not need to operate its own SOC, but it must have detection and escalation capability. In practice, this can be an internal team, MSSP, MDR, SOC as a Service or a mixed model.
A healthcare provider must have an incident procedure connecting IT, clinical staff, board, DPO, communications, legal, suppliers and public or private owners. The procedure should answer: what do we do in the first 15 minutes, first hour and first day?
Health data is one of the most sensitive categories of personal data. The European Health Data Space will increase the importance of secure access, exchange and reuse of medical data. Cybersecurity and data protection therefore cannot be managed separately.
AI can support diagnostics, triage, image analysis, documentation, administrative automation and research. It can also create risks: data leakage into public tools, wrong recommendations, shadow AI, lack of validation, attacks on models and supplier dependency.
Clinical staff have little time and work under pressure. Training must be short, practical and role-based. The board, doctor, nurse, reception team, IT team and clinical engineer need different training.
A cyberattack can affect treatment. Cybersecurity must therefore be managed together with patient safety, business continuity and clinical risk.
The provider has a paper procedure, but never checked whether staff can operate without EHR, email and online results.
The hospital secures office computers, but does not know which medical devices are connected to the network, who manages them and how they are updated.
A copy exists, but nobody knows whether HIS, EHR, PACS or LIS can be restored within acceptable time.
Medical system suppliers have remote access without MFA, named accounts, logging and clear incident responsibilities.
The board does not need only alert numbers. It needs to know which clinical services are at risk, which decisions are needed and what the cost of inaction is.
Staff use AI tools to summarize documents or draft content, but the provider has no rules for patient data and accountability.
One e-learning course does not change behavior. Short modules, simulations, reminders and scenario exercises are needed.
A county hospital uses HIS, EHR, PACS, RIS, LIS, Microsoft 365, finance system, patient portal and several remote suppliers. The board knows that healthcare is under increasing requirements, but cybersecurity has so far been treated as an IT task.
The first review shows several gaps: incomplete MFA for administrators, backup without current restore test, no register of medical devices on the network, incomplete list of suppliers with remote access, no exercise of working without EHR and no CSIRT incident reporting procedure. At the same time, clinical staff say they are afraid to report mistakes because they do not know what counts as an incident.
The hospital implements a 90-day plan. It creates a critical system register, enables MFA, performs a restore test, prepares a ransomware playbook, assesses suppliers, performs basic inventory of medical devices and runs a tabletop involving board, IT, DPO, emergency department, diagnostics and communications. After the exercise, the board sees not only technical gaps, but also patient, communication and operational impact. This is a real start of cyber resilience.
This topic can be connected with further reading and CCyber services to move from the EU plan to concrete action in a healthcare provider.
ccyber.io helps healthcare providers translate the European action plan, NIS2, national cybersecurity rules, GDPR, EHDS and AI Act into a practical cyber resilience programme. We combine patient safety, IT, medical devices, suppliers, compliance, training and risk management.
We can support your organization with:
The best first step is a Healthcare Cyber Resilience Workshop. In a short workshop, the provider can identify critical clinical systems, key gaps, ransomware readiness and actions needed in the first 90 days.
The action plan itself is strategic and coordination-oriented. Direct obligations mainly come from NIS2, national cybersecurity rules, GDPR, EHDS, AI Act, medical regulations, contracts and ownership requirements.
It depends on status, activity type, size, sector and national law. A healthcare provider should perform an applicability assessment and not assume automatically that obligations do not apply.
First critical services, backup, MFA, incident response, emergency work, suppliers, monitoring and training. Then more advanced elements such as SOC, automation and mature GRC.
No. Backup is necessary, but it must be protected, tested and connected with recovery procedure, communication, emergency work, system isolation and board decisions.
Not exactly. Medical devices require cooperation between IT, clinical engineering, supplier and clinical staff. Certification, availability, updates, patient impact and emergency operation must be considered.
Yes. A smaller provider may not have a full security team, but it still processes medical data, uses digital systems and can be targeted by phishing, ransomware or data leakage.
Short, practical and repeatable training works best. It should be scenario-based: phishing, suspicious attachment, EHR outage, data leak, ransomware, paper procedures and safe AI use.
Start with the map of clinical services, critical systems, backup, MFA, suppliers, ransomware procedure and a simple board report. Then plan a 90-day action programme and the first tabletop exercise.
The European action plan for cybersecurity of hospitals and healthcare providers shows that healthcare requires a dedicated approach. A cyberattack on a healthcare provider can affect patients, procedures, diagnostics, data access and public trust.
The most important actions are not only tool purchases. A provider needs a security management system, risk register, critical service map, MFA, backup, restore tests, medical device protection, supplier assessment, monitoring, incident procedures, training and board reporting.
The best rule is: do not ask only whether the hospital has safeguards. Ask whether the hospital can continue patient care when digital systems fail, whether it knows whom to notify, how to restore data and how to maintain clinical work despite an incident.
We write about regulations such as NIS2, DORA, CRA and ISO 27001, cybersecurity for SMEs and critical infrastructure, as well as cyber hygiene, emerging threats and building security awareness within organisations.
Every article delivers practical knowledge - no jargon, just concrete steps you can act on to effectively protect your data, people and business continuity.