In this episode, we spoke with András Érczfalvi, a TrendFM host, about the first NIS2 challenges and the related tasks. The episode aired on March 2, 2026.
Participants
András Érczfalvi - TrendFM
András Tresch - Quattrosoft
June 30, 2026. That’s how much time companies have left.
This isn’t just another vague deadline that will eventually be postponed. It’s a specific date by which the first cybersecurity audit must take place—and anyone who isn’t prepared for it can expect serious fines and operational risks.
On March 2, I discussed this topic as a guest on TrendFM’s “Afternoon Monitor” program with András Érczfalvi. You can listen to the full hungarian recording here. In this article, I summarize my key points.
The High School Graduation Effect
The situation surrounding the NIS2 Directive is eerily reminiscent of high school graduation exams. Everyone puts off preparing until the very last minute. Then comes the chaos, the panic, the dread—and somehow we’ll get through it.
We’ve already seen this pattern in the corporate world with the GDPR, ISO audits, and now NIS2. The difference is that a student who fails the high school graduation exam can take a makeup exam. With NIS2, the situation is different: the audit findings require immediate action, and failure to comply comes at a cost—one that can really hurt.
The Numbers That Matter
At least 2,500 organizations in Hungary fall under the scope of NIS2—some estimates put the number as high as 4,000 to 5,000. Classification is based on revenue, number of employees, number of customers, and criticality to the national economy.
The list of requirements contains more than 900 items. Nearly 400 of these relate to the “high” classification, and as part of that, nearly 200 specifically pertain to IT systems. This isn’t 10, and it isn’t 5. It’s 160–180 items that must be checked off for each system.
This is the point where many executives are faced with the question of whether their IT systems are even capable of meeting these requirements.
Why aren’t there any more delays?
During the radio discussion, the question came up as to whether the authority would grant another extension. My answer is a clear no.
There have been delays in the past—partly because the itemized breakdown and the organizational framework were established later in Hungary. But now the regulatory framework is in place, along with the categories and lists of criteria. Companies registered on a self-declaration basis in the summer of 2025 and submitted their classifications. The first audit is due by June 30.
The audit will result in findings. It’s even possible that an organization will be told: “You assigned a significant rating, but this is actually on the high side.” And then it will have to meet the full list of requirements applicable to the “high” category.
The fines are relatively high. In audits conducted by the MNB and similar bodies, we’ve seen that during the first round, they typically say, “Fix this.” But if the same deficiency is found in the second round, that results in a fine.
The attack surface has increased dramatically
The issue of cybersecurity goes far beyond NIS2 compliance. It’s worth taking a look at how much the attack surface—the areas where a company may be vulnerable—has changed in recent years.
First, there’s the cloud. As soon as an organization starts using cloud services, a dual responsibility arises: that of the service provider and that of the organization itself. We’ve seen databases uploaded to the cloud without passwords—and containing the personal data of billions of people.
Second, there’s the use of AI. Do we know what happens to the data? At the outset, all available data in the world was downloaded from the internet to train the systems, without any kind of consent. Now lawsuits are coming one after another in the United States as well, but the genie has long since been out of the bottle. Service providers are required to store chat logs for six months so that, in the event of an investigation (e.g., by the FBI), they can hand over a record of what was said.
These systems are also constantly under attack. If a security incident occurs at the service provider, data could become accessible for up to six months retroactively. It’s not certain, but it’s a possibility—and that’s the essence of risk management.
Third, there are the API interfaces—the communication channels between internal systems. In many organizations, these interfaces operate without authentication because “they’re querying from within the internal network anyway.” Someone queries the HR database to find out who the CEO is—the system returns the answer. “How much does he earn?” It returns that information as well. This is because there are no settings in place to determine who is making the query, what their permissions are, and what data they are authorized to access.
And now for the reality: there was a large Hungarian financial institution where external developers had two computers. One was on the internal network for work, and the other was connected to the Internet for company emails. The developers managed this for a few months. But since they’d been working there for years, after a while they simply plugged the external computer’s Internet cable into the internal network. And it went on like that for years. The internal network was open to the internet, and no one noticed.
It’s certain that security solutions there have evolved since then. But it’s also possible that developers have become more sophisticated. Auditing APIs, implementing horizontal and vertical access restrictions—these are all requirements that need to be addressed. This is particularly important when moving to the cloud, where the concept of an “isolated internal network” loses its meaning.
NIS2 aims to regulate these matters. Not because the EU is bored, but because the threat is real and growing exponentially.
What Is Expected of IT Systems
The nearly 200 requirements pertaining to IT systems may require significant improvements from vendors who have not previously focused specifically on security architecture.
There are systems where this takes a few months of work. But I’ve also seen cases where the turnaround time is ten, fifteen, or twenty months—and it’s not a matter of just throwing a hundred programmers at it and having it done in a month. Ideally, five to ten people can work effectively on such a project in parallel.
At Quattrosoft, we began working on this in early 2024, when even the draft of the directive’s itemized breakdown had not yet been finalized. By mid-2024, we had assessed the discrepancies, and by the end of the year, we had met all the high-level criteria as well as a significant portion of the optional items.
Why did we start so early? We felt it was important to complete the development by the end of 2025. BürOffice had a solid foundation; it inherited security and audit capabilities from the development of the earlier Vízum system—we incorporated this technological foundation into our system. For us, security wasn’t an afterthought, but rather an integral part of the originally planned architecture. As a result, the discrepancy wasn’t huge, but it still needed to be addressed. For our clients, NIS2 compliance does not entail—and will not entail—any additional costs. BürOffice meets the requirements for high-level compliance “out of the box.”
If you’re just getting started, begin with these two questions
If, as a company executive, you are now realizing that your company falls under the scope of NIS2, there are two things you should consider first:
The first is the organizational aspect. You’ll need to develop processes, conduct a risk assessment, implement risk management, and carry out a penetration test. This is the organization’s own responsibility, and typically requires the involvement of external consultants.
The second area is IT systems. We need to review each system individually to determine which of the 900 requirements apply to it. At an average-sized large enterprise—think of a financial institution with several hundred systems—this is a separate task for each system. Both the infrastructure components (application server, database management system, web server) and the application-level requirements must be examined.
In the financial sector, incidentally, it is not NIS2 itself but the DORA regulation that applies to market participants—this is the adaptation of the NIS2 Directive for financial firms. It is interesting to note that while NIS2 features a well-structured list of more than 900 criteria, I have not yet seen a similarly itemized breakdown of DORA’s IT requirements. Currently, this is being treated as a contractual matter—but it is likely that a detailed set of requirements will be established over time.
Ensuring the compliance of IT systems is the responsibility of software vendors—but if a vendor’s system does not comply, there are two options: phase out the system or modify it. Procrastination is not an option.
If someone is procuring a new system now and knows it falls under the scope of NIS2, the first question should be whether the system meets NIS2’s high standards. If commissioning a custom development, NIS2 requirements should be included among the non-functional requirements right from the start. Retrofitting it is much more expensive and also riskier.
Don’t Let the System Be the Bottleneck
Think about it: you have a functional requirement—whether it’s invoicing, document management, or customer service. On top of that come the NIS2 requirements. If you request proposals from vendors based solely on functional requirements, the winning vendor may not necessarily be the best choice once security requirements must also be incorporated.
These requirements must be addressed collectively as early as the request for proposals stage.
Competitive advantage or necessity?
Both. In the short term, it is a necessity that must be met. In the longer term, however, organizations that prepare thoroughly now will gain a competitive advantage.
What happens after the first audit?
Once the audit is completed, the organization receives a nonconformity report, similar to those issued after ISO audits. The report will list the deficiencies, which must be corrected by a specified deadline.
We know from similar procedures carried out by the MNB and other authorities that they are typically patient in the first round and expect us to correct the issues. But if this is not done by the set deadline—say, by the end of 2026—and if a special audit also confirms this, a warning alone will no longer suffice. The fines are severe, and the regulator has the tools to enforce compliance.
NIS2 compliance isn’t just paperwork. A proper audit reduces operational risks, increases customer trust, and simplifies partnerships. Sooner or later, it will become a requirement in the supply chain as well—anyone who can’t demonstrate compliance will be left out.
The question isn’t whether it’s worth investing in NIS2 compliance. The question is whether you can afford not to.
Listen to the full conversation on TrendFM’s “Afternoon Monitor” program: NIS2 in the Spotlight: The Deadline for the First Mandatory Cybersecurity Audit Is Approaching (Hungarian)
András Tresch, Managing Director of Quattrosoft Kft.
