Cybersecurity for Businesses – Legal Services and Implementation (NIS2, DORA, KSC)

We offer comprehensive consulting services in the area of cybersecurity. We assist organizations in identifying their obligations, auditing their processes, and implementing procedures that comply with EU and national regulations.

LO:ME Law Firm for Cybersecurity

What does cybersecurity consulting involve?

Ensuring digital security today is not only a matter of having the right IT security measures in place, but also a necessity to comply with legal requirements.

We provide our clients with services grouped into three key areas:

Regulatory Audits and Compliance Assessments (NIS2, KSC, CRA)

New industry regulations establish liability for a lack of adequate safeguards. We help you precisely determine your organization’s legal status and implement optimal, mandatory solutions that comply with national and EU standards. In doing so, we take into account your company’s interests, needs, and business practices.

Here’s what we can do for you:

NIS2 and KSC Compliance Audit. We verify whether your company is subject to the provisions of the National Cybersecurity System and identify the obligations it must implement.
NIS2 and KSC Implementation. We develop procedures, documentation, a division of responsibilities, risk management policies, and an incident reporting system.
Cyber Resilience Act (CRA) Compliance Audit. We verify the obligations of manufacturers, importers, and distributors of products containing digital components—including software and devices covered by the CRA—and identify the actions necessary to ensure compliance.
Legal cybersecurity audit. We analyze documentation, contracts, the structure of responsibilities, and security processes. We identify gaps and propose a corrective action plan.
Legal Gap Analysis. We compare the security measures and procedures in place with legal requirements, industry standards, and contractual obligations.
Cybersecurity Obligations Map. We determine which regulations, regulatory decisions, industry standards, and customer requirements apply to your organization.

Corporate Governance, Policies, and Awareness-Building

Effective protection requires the commitment of management and the establishment of transparent operating rules within the organization. We build a corporate governance framework, minimize the personal risks faced by board members, and enhance staff competencies.

Here’s what we can do for you:

Cybersecurity Compliance Strategy. We develop a plan for implementing legal obligations, define priorities, assign responsible parties, set deadlines, and identify required documentation.
Cybersecurity Corporate Governance. We define the responsibilities of the management board, supervisory board, IT department, compliance department, security department, data protection department, and legal team.
Management Board Liability for Cybersecurity. We assess the risk of personal liability for members of these bodies and develop solutions to mitigate that risk.
Cybersecurity Policy. We draft an overarching document governing the management of information security, systems, and digital services.
Employee Monitoring and Internal Threats. We assess the legality of monitoring, access controls, and actions taken against employees suspected of violations.
Training for the Management Board. We explain the responsibilities of corporate bodies, obligations under NIS2, KSC, and DORA, and the decision-making process during an incident.
Employee training. We teach employees how to identify threats, report incidents, protect information, and use company systems properly.

Supply Chain Security, IT Contracts, and Transactions

Vulnerabilities in the external systems of business partners and cloud providers are one of the main sources of incidents. We draft and review technology contracts to precisely identify risks and meet audit requirements.

Here’s what we can do for you:

Contracts with IT vendors. We draft and negotiate security requirements, liability for incidents, audits, vulnerability reporting, and remediation.
Cloud agreements. We verify data security, infrastructure location, subcontractors, service continuity, backups, and termination procedures.
ICT outsourcing agreements. We tailor contracts to meet the requirements of NIS2, KSC, DORA, GDPR, and sector-specific regulations.
Support During Client Audits. We represent the company during security audits conducted by a client, bank, investor, or business partner.
Cybersecurity Clauses in Transaction Agreements. We draft representations, warranties, closing conditions, and liability provisions for disclosed incidents.

Response to Cyberattacks, Disputes, and Proceedings Before Regulatory Authorities

In the event of a critical incident, it is crucial to take immediate action in accordance with statutory timeframes and deadlines. We provide legal assistance during a crisis, communicate with government agencies, and pursue claims for damages.

Here’s what we can do for you:

Legal Services for Cyberattacks. We coordinate the legal aspects of responding to a cybersecurity incident—from its detection and assessment of notification obligations, through communication with authorities and business partners, safeguarding the organization’s interests, and supporting proceedings, to pursuing claims and settling damages.
Cooperation with Cybersecurity Authorities. We represent clients in their dealings with CSIRTs, competent authorities, regulators, and institutions responsible for national security.
Cooperation with the Police and the Prosecutor’s Office. We prepare reports of suspected criminal offenses and represent the affected organization.
Proceedings before regulatory authorities. We prepare responses, explanations, documentation, and defense strategies for audits and proceedings related to cybersecurity.
Defense against administrative penalties. We represent businesses in cases involving failure to implement required security measures or improper incident reporting.
Disputes following a cyberattack. We handle cases involving compensation for damages, lost data, business interruptions, breach of contract, and the costs of mitigating the effects of an incident.
Claims against IT providers. We hold providers of systems, cloud services, hosting, and outsourcing liable for errors or inadequate security measures.

Ongoing legal counsel and regulatory monitoring

The legal environment and technical standards in cybersecurity are constantly evolving. We offer oversight to ensure procedures comply with the law, as well as direct access to experts for day-to-day operational matters.

Here’s what we can do for you:

Ongoing regulatory monitoring. We keep you informed about changes in the law, new guidelines from regulatory authorities, and obligations relevant to your business.
Ongoing cybersecurity legal support. We provide ongoing consultations, documentation updates, contract support, and readiness to handle incidents.

Why Choose Cybersecurity with LO:ME?

Combining Law and Technology

We translate complex regulatory requirements into the realities of the IT environment and the specific processes within your organization. As a result, you receive solutions that are fully compliant with NIS2, DORA, and CRA standards—solutions that do not disrupt your day-to-day business operations.

Protection of Management

The new regulations impose direct, personal liability on management for negligence in the area of cybersecurity. We design corporate governance structures to minimize legal risk.

Implementations That Work in Practice

We develop clear guidelines for incident response and crisis management. In the event of a real cyber threat or a regulatory audit, your team will know exactly how to act immediately and in compliance with the law.

Contact us

Are you wondering if your company is subject to NIS2, DORA, or KSC regulations? Or perhaps you need to update your existing documentation? Schedule a consultation with our team.

Technology creates safeguards, but it is procedures and accountability that determine security.