Case study · Manufacturing for the automotive industry
Dourdin Romania: getting ready for NIS2, from the audit to measures and documents
When it learned that NIS2 applies to it, Dourdin Romania relied on the team that already handles its IT support and maintenance. We started with an audit, applied the security measures on every computer and prepared the compliance documents.
- Since 2022a RezolvIT client
- 1dedicated account manager
- NIS2audit, measures and documents
In short
What did we do for Dourdin Romania?
Dourdin Romania has been a RezolvIT client since 2022: we handle its IT support and maintenance, with a dedicated account manager, alongside the company’s IT manager. When the company learned that NIS2 applies to it, we prepared for it together.
The challenge
NIS2 brought new security and documentation obligations, and the company didn’t know where to start.
The solution
An audit against the NIS2 requirements, then access policies, encryption and antivirus on every computer, plus the compliance documents.
The result
The company knows exactly where it stands on NIS2 and what’s left to do, and the basic measures are in place.
The challenges
What were the challenges?
Dourdin Romania is part of a French group that makes decorative components for the automotive and transport industries. With GEO 155/2024, which brings NIS2 into Romanian law, the company learned that the new rules apply to it.
- It wasn’t clear what NIS2 actually required of the company: which measures, which documents, in what order.
- The law requires security measures that can be demonstrated: access policies, data protection on every computer, written rules.
- The compliance documents had to be written for the company, not copied from a template.
- The company’s IT manager needed help with the project, on top of the day-to-day work.
- Everything had to be done without disrupting production.
The decision
How did we choose the solution?
Because we’ve handled its IT support and maintenance since 2022, we already knew the company’s computers, servers and network. Together with Dourdin’s IT manager, we settled four questions.
Where do we start?
With an audit against the NIS2 requirements: what’s already there, what’s missing and what’s most urgent. It produced the list of priorities.
What do we fix first?
The measures that directly protect data: access policies, encryption and antivirus on every computer. The documents were written in parallel.
Who does what?
The company’s IT manager set the priorities, and we ran the audit, applied the measures and prepared the documents. The dedicated account manager followed the plan.
What remains after the project?
A plan with the next steps, followed up as part of day-to-day support, so the company always knows where it stands on NIS2.
The implementation
What did we implement?
The NIS2 project ran alongside day-to-day support and maintenance, by the same team, working with the company’s IT manager.
The NIS2 audit
We compared the company’s security with the requirements of NIS2 and GEO 155/2024 and showed clearly what’s missing and in what order to fix it.
IT audit →Access policies
Each employee has access only to the data and applications they need, under written rules applied the same way to everyone.
IT security →Encryption and antivirus on every computer
Disks are encrypted, so data can’t be read if a laptop is lost, and the antivirus is centrally managed on every computer.
The compliance documents
The policies and procedures NIS2 requires, written for the company, plus the plan with the next steps.
IT consulting →IT support for employees
Since 2022, Dourdin’s employees have had a single phone number for any IT problem, remotely or on site.
IT support →Maintenance, with a dedicated account manager
Computers, servers and the network are maintained by the same team, and the dedicated account manager is the company’s point of contact.
IT maintenance →
The rollout
How did the implementation go?
The measures were applied gradually, computer by computer, so production and day-to-day work never stopped.
The audit
We checked the computers, servers, network, accounts and existing documents against the NIS2 requirements.
The plan
What was missing became a plan, in order of priority, agreed with the company’s IT manager.
The measures
We applied the access policies, encryption and antivirus on every computer, without stopping production.
The documents and next steps
We prepared the compliance documents, and the remaining steps are followed by the dedicated account manager as part of day-to-day support.
Results and conclusions
What changed, and what did we learn?
Dourdin now knows exactly where it stands on NIS2 and what’s left to do, and the basic measures are in place on every computer.
Before
- Unclear what NIS2 required of the company
- No list of security priorities
- No compliance documents
After
- A NIS2 audit and a clear list of priorities
- Access policies applied to every employee
- Encryption and antivirus on every computer
- The compliance documents
- Remaining steps followed by the account manager
NIS2 starts with an audit
Without a clear picture of what’s missing, you don’t know where to start. The audit turned the law’s requirements into a list of steps.
A provider that already knows the company
Because we already handled its IT support and maintenance, the audit started from an infrastructure we knew, with no time lost on handover.
The basics matter most
Access policies, encryption and antivirus on every computer cover a large share of everyday risks.
Compliance doesn’t end with the documents
NIS2 requires the measures to be kept up to date. That’s why the remaining steps and checks are part of day-to-day support.
Testimonial
What does the client say?
Alexandru Mihai, IT Manager at Dourdin Romania, on getting ready for NIS2.
“When we found out NIS2 applied to us, we didn’t know where to start. RezolvIT showed us what we were missing, set up access policies, encryption and antivirus on every computer, and helped us with the compliance paperwork. Now we know exactly where we stand and what’s left to do.”
Tell us what’s slowing you down. We’ll call you.
It takes 30 seconds, and a specialist will call you back within 2 business hours.
- free IT & AI audit, no obligation
- a report with risks and concrete recommendations
- a clear offer, with a fixed monthly plan
Prefer the phone? 031 432 8681