JavaScript is disabled

This site requires JavaScript to work properly. Please enable JavaScript in your browser's settings and reload the page.

If the reload button doesn't work, JavaScript is still disabled.

Home
Ecosystem
Sectors
Solutions
About
Contact

Discover

English
Italiano
Deutsch
Français

All tools
IP Reputation
Botnet Tracking
Malware Analysis
CVE Intelligence
Email Checker
DNS Permutation
Compliance Check

All tools 7

IP Reputation
Botnet Tracking
Malware Analysis
CVE Intelligence
Email Checker
DNS Permutation
Compliance Check

Is your network compliance-ready?

Thirteen questions on what NIS2, the Swiss Federal Act on Data Protection (FADP) and the ICT Minimum Standard expect from you: assets and vulnerabilities, monitoring, identities, people and web traffic. You get a score, your gaps and the solutions that close them.

Where does your organisation operate?

Switzerland European Union Both

Since 2023: The revised FADP applies to every company in Switzerland that processes personal data.
Art. 8 FADP: Requires technical and organisational measures appropriate to the risk.
ICT Minimum Standard: The federal reference framework, based on the NIST Cybersecurity Framework and ISO 27001.

€10M or 2%: Maximum NIS2 fine for essential entities: €10M or 2% of worldwide annual turnover, whichever is higher.
Art. 21 NIS2: Lists the security measures required, from vulnerability handling to staff training.
Personal liability: Management can be held accountable for non-compliance.

€10M or 2%: Maximum NIS2 fine for essential entities: €10M or 2% of worldwide annual turnover, whichever is higher.
Since 2023: The revised FADP applies to every company in Switzerland that processes personal data.
Supply chain: EU customers in NIS2 sectors may require these measures from you as a supplier.

About 4 minutes. Your answers never leave your browser.

Inventory Do you know exactly how many computers, servers and devices are connected to your network?

FADP Art. 8 · ICT Minimum Standard ID.AM-1

NIS2 Art. 21(2)(i)

NIS2 Art. 21(2)(i) · FADP Art. 8 · ICT Minimum Standard ID.AM-1

No Roughly, from a rarely updated spreadsheet Most of them, from a list kept by hand Yes, from an inventory updated automatically

Why it matters: You can't protect, patch or report on a system you don't know exists.

Inventory Do you know which software, and which versions, run on your computers and servers?

FADP Art. 8 · ICT Minimum Standard ID.AM-2

NIS2 Art. 21(2)(i)

NIS2 Art. 21(2)(i) · FADP Art. 8 · ICT Minimum Standard ID.AM-2

No Only for servers For most systems, collected by hand Yes, collected automatically

Why it matters: Most attacks exploit known flaws in a specific version of a specific program.

Inventory Would you notice if an unknown device appeared on your network?

FADP Art. 8 · ICT Minimum Standard DE.CM-7

NIS2 Art. 21(2)(i)

NIS2 Art. 21(2)(i) · FADP Art. 8 · ICT Minimum Standard DE.CM-7

No Only by chance Through occasional manual checks Yes, scheduled scans flag it

Why it matters: Forgotten or unauthorised devices are rarely patched and rarely watched.

Vulnerabilities How often do you scan your systems for known vulnerabilities?

FADP Art. 8 · ICT Minimum Standard DE.CM-8

NIS2 Art. 21(2)(e)

NIS2 Art. 21(2)(e) · FADP Art. 8 · ICT Minimum Standard DE.CM-8

Never Once a year or less Every quarter Monthly or continuously

Why it matters: New vulnerabilities are published every day. A yearly scan sees one day out of 365.

Vulnerabilities Are you still running software that no longer receives security updates?

FADP Art. 8 · ICT Minimum Standard ID.RA-1

NIS2 Art. 21(2)(e)

NIS2 Art. 21(2)(e) · FADP Art. 8 · ICT Minimum Standard ID.RA-1

We don't know Yes, and we have no list of it Some, and we know exactly which No, or every case is known and isolated

Why it matters: Unsupported software no longer gets security fixes, so every new flaw stays open for good.

Vulnerabilities When a critical vulnerability is found, how quickly is it fixed?

FADP Art. 8 · ICT Minimum Standard PR.IP-12

NIS2 Art. 21(2)(e)

NIS2 Art. 21(2)(e) · FADP Art. 8 · ICT Minimum Standard PR.IP-12

We don't track this Within months Within weeks Within days, with agreed deadlines

Why it matters: Attackers often exploit a new vulnerability within days of its publication.

Vulnerabilities When a critical new flaw is announced, do you know within hours whether your systems are affected?

FADP Art. 8 · ICT Minimum Standard ID.RA-2

NIS2 Art. 21(2)(e)

NIS2 Art. 21(2)(e) · FADP Art. 8 · ICT Minimum Standard ID.RA-2

No, we'd find out if something happened Only after days of manual checks Within a day or two, for the main systems Yes, within hours, thanks to an up-to-date inventory and scans

Why it matters: Attackers start scanning the internet for a new flaw within hours of its announcement.

Evidence Could you show an auditor reports and a history of these checks?

FADP Art. 8 · ICT Minimum Standard PR.IP-7

NIS2 Art. 21(2)(f)

NIS2 Art. 21(2)(f) · FADP Art. 8 · ICT Minimum Standard PR.IP-7

No Only scattered notes Some reports, but not regularly Yes, regular documented reports

Why it matters: Being secure isn't enough: you have to be able to prove it.

Evidence Do you measure whether your security is improving over time?

ICT Minimum Standard PR.IP-7

NIS2 Art. 21(2)(f)

NIS2 Art. 21(2)(f) · ICT Minimum Standard PR.IP-7

No Gut feeling only Occasionally, without a fixed metric Yes, with a score we track

Why it matters: Without a measure you can't tell whether your effort is working, or show it to management.

Monitoring If someone were moving data out of your network right now, would you notice?

FADP Art. 8 · ICT Minimum Standard DE.CM-1

NIS2 Art. 21(2)(b)

NIS2 Art. 21(2)(b) · FADP Art. 8 · ICT Minimum Standard DE.CM-1

No Probably not, we have no monitoring Maybe, from logs we check by hand Yes, monitoring raises an alert

Why it matters: Many breaches are discovered weeks or months later, often by someone outside the company.

Identities If a Microsoft 365 account were taken over, how soon would you know?

FADP Art. 8 · ICT Minimum Standard DE.CM-3

NIS2 Art. 21(2)(i)

NIS2 Art. 21(2)(i) · FADP Art. 8 · ICT Minimum Standard DE.CM-3

Only if the user told us Only once something visibly breaks Within days, by reviewing the logs Immediately: an alert flags anomalous sign-ins

Why it matters: A compromised mailbox is used to defraud and phish your customers, often for weeks.

People Do you know how many of your employees would click on a well-crafted phishing email?

FADP Art. 8 · ICT Minimum Standard PR.AT-1

NIS2 Art. 21(2)(g)

NIS2 Art. 21(2)(g) · FADP Art. 8 · ICT Minimum Standard PR.AT-1

We have no idea We assume few, but never checked We ran a test once Yes, we run regular simulations and track the results

Why it matters: Phishing is still the most common way in, and training only works if you measure it.

Web traffic Do you know which websites and domains your computers connect to, and are malicious ones blocked?

FADP Art. 8 · ICT Minimum Standard DE.CM-4

NIS2 Art. 21(2)(g)

NIS2 Art. 21(2)(g) · FADP Art. 8 · ICT Minimum Standard DE.CM-4

No Only through the browser's own warnings We block some categories, without reports Yes, malicious domains are blocked and logged

Why it matters: Phishing links and malware both need to reach a domain: blocking it stops the attack even after the click.

Your result

At risk

Basic visibility is missing. An audit or an incident now would be hard to handle.

Partly prepared

The basics are there, but gaps and missing evidence remain.

Well on the way

Most measures are in place. Close the gaps and make them provable.

Ready

Keep it up, and keep the evidence.

Score by area

Inventory

Vulnerabilities

Evidence

Monitoring

Identities

People

Web traffic

Recommended for you

Based on your answers, these are the EXYS solutions that close your gaps, starting from the most urgent.

No major gaps. The next step is proving it with a measured result on your real network.

EXYS7600 OCELOT
Closes your gaps in InventoryVulnerabilitiesEvidence
- Inventory. Discovers the devices on your network, including undocumented ones, and builds an inventory of the software installed on your endpoints.
- Vulnerabilities. Scheduled scans detect vulnerabilities as soon as they appear and flag obsolete or insecure devices, so you know immediately what needs fixing.
- Evidence. Detailed reports (executive summary, inventory, findings) document every scan, and the network score shows how your security improves over time.
Learn more about EXYS7600 OCELOT
EXYS7950 KONDRA
Closes your gaps in Monitoring
Monitors your network, events and endpoints in real time and alerts you as soon as something anomalous happens, with the history you need to respond to an incident.
Learn more about EXYS7950 KONDRA
EXYS AURA
Closes your gaps in Identities
Watches your Microsoft 365 audit logs around the clock and flags a compromised account in real time, including sign-ins that bypass MFA. Our analysts follow up on every alert.
Learn more about EXYS AURA
EXYS1400 POSEIDON
Closes your gaps in People
Runs realistic phishing simulations and shows who opened the email, clicked the link, submitted their credentials or reported it, so you can see awareness improve from one campaign to the next.
Learn more about EXYS1400 POSEIDON
EXYS5100 SECURE DNS
Closes your gaps in Web traffic
Blocks phishing links and malware domains for your whole network, and logs every blocked request so suspicious activity can be traced to its origin.
Learn more about EXYS5100 SECURE DNS

Let's go through your results together

A self-assessment is a starting point. Our specialists can show you how these solutions work on your network and where to begin.

Talk to us

This self-assessment is an indication only, not legal advice or a formal audit. Whether NIS2 applies depends on your sector, size and national law; the ICT Minimum Standard is a recommendation, not an obligation.

EXYS combines hardware and software expertise with a strong focus on innovation, performance, optimisation and integration.

Cybersecurity Ticino · Swiss Made

Ransomware data: RansomLook ( CC BY 4.0 )