Komplyo blog
Security & compliance, explained
Page 2 of 2 of the Komplyo articles.
ENISA's SME maturity model and the CRA: what it measures, what it does not
In July 2026 ENISA published a cyber maturity self-assessment model for SMEs that manufacture products with digital elements: 5 domains, 25 questions scored 1 to 5, three profiles, about two hours. Useful for locating your processes, insufficient for a CRA file. How to combine the two.
- CRA
- EU regulation
- ENISA
- Maturity
NIS2: essential or important entity? The classification test explained
How to determine whether your company is an essential or important entity under NIS2: Annex I and II sectors, size thresholds, size-independent special cases, and what classification actually changes (supervision, penalties, reporting).
- NIS2
- Compliance
- Classification
30 compliance documents from a single assessment: how it works
Security policy, ISO 27001 SoA, risk register, business continuity plan, DPIA, records of processing, NIS2 scope memo… How one assessment aligned on NIST CSF 2.0 generates 30+ deliverables ready for your customers and auditors.
- Compliance
- NIST CSF
- ISO 27001
- GDPR
- NIS2
NIST CSF 2.0 for SMEs: the six functions and how to implement them
The NIST Cybersecurity Framework 2.0 organizes cyber risk management into six functions: Govern, Identify, Protect, Detect, Respond, Recover. What each function expects from an SME, category by category, and a 90-day implementation sequence based on the NIST SP 1300 guide.
- NIST CSF
- Compliance
- Cybersecurity
The Cyber Resilience Act for SMEs: manufacturer obligations and timeline
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to products with digital elements placed on the EU market. The product classes, the manufacturer obligations, the 24h/72h/14-day reporting rule and a 24-month compliance roadmap.
- CRA
- Compliance
ISO 27001 or SOC 2 for an SME: deliverables, recognition and how to choose
ISO 27001 produces a certificate issued by an accredited body, valid three years with annual surveillance. SOC 2 produces an attestation report issued by a CPA firm, renewed every year. What each framework requires and produces, what it costs under the published rules, and the criteria that determine the choice for an SME.
- ISO 27001
- SOC 2
- Compliance
Business Impact Analysis for SMBs: a five-step method
A Business Impact Analysis (BIA) prioritizes assets by business criticality rather than technical value. A five-step method for SMBs, based on NIST SP 800-34, NIST CSF 2.0, CISA resources and ANSSI's EBIOS Risk Manager.
- BIA
- NIST CSF
- Business continuity
NIS2 Directive for SMEs: scope, Article 21 measures and deadlines
Is your SME in scope for NIS2? The size and sector criteria, the 10 Article 21 measures, the 24h/72h/1-month reporting rule, the penalty framework and a 12-month compliance roadmap.
- NIS2
- Compliance
- NIST CSF
Get the security policy template
An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.