Cybersecurity for companies and institutions
A client asks for proof of your security. The board wants to know where the company stands. Your insurer sends a questionnaire. Strategic tests your systems the way an attacker would (penetration testing) and looks for their known weaknesses (vulnerability assessment). We prepare you to handle an incident and recover from it. And we help you meet the requirements of NIS2, the EU cybersecurity directive, including when you are a supplier to companies that fall under it.
01 · copy the link to this sectionThe situation
Under NIS2, documentation carries as much weight as technical testing.
A major client sends a supplier questionnaire. It asks about two-factor authentication, data backups, incident handling and the date of your last penetration test. Your IT team knows almost all the answers. Few of them are written down.
A statement is not enough. You need systems that have been tested, fixes that have been made, and documents that IT, management and clients can all read. Without them, every new request costs weeks, just when a contract depends on those answers.
02 · copy the link to this sectionWhat we do
Every engagement starts from a written scope. It sets out which systems, which people and which dates.
CYBTechnical testing
Penetration testing and vulnerability assessment
A vulnerability assessment looks for known weaknesses in your systems and applications. A penetration test then tries to exploit them, as an attacker would, within a scope authorised in writing. The report ranks the fixes by severity. The retest is agreed with you.
AIArtificial intelligence
03 · copy the link to this sectionReference
Updated 15 September 2026
In short: NIS2 requires medium-sized and large companies in many sectors to protect their systems and data, to check their suppliers and to report serious attacks within 24 hours. Companies outside its scope often receive its requirements anyway, through a client.
NIS2 is Directive (EU) 2022/2555. In Italy it has applied since 16 October 2024 through Legislative Decree 138/2024 (D.Lgs. 138/2024, Italy’s NIS2 law), and the ACN enforces it.
| Topic | What it means for you | Reference |
|---|---|---|
| Who is in scope | The law covers organisations in the sectors listed in Annexes I to IV, as a rule medium-sized and large companies. For some activities, such as DNS services, size does not matter. | Legislative Decree 138/2024 and ACN FAQs |
| Registration | Organisations register every year from 1 January to 28 February on the ACN portal. The ACN then tells them whether they are on the list. | ACN, ‘Ambito e registrazione’ (scope and registration) |
| Leadership | Directors approve and oversee the measures, are liable for infringements and must be trained. | Legislative Decree 138/2024, Article 23 |
| Suppliers | The security of direct suppliers is one of the mandatory measures. | Legislative Decree 138/2024, Article 24 |
| Significant incidents | They are reported to CSIRT Italia, the national team that responds to cyber attacks. An early warning is due within 24 hours, a notification within 72 hours and a final report within one month. | Legislative Decree 138/2024, Article 25 |
| Deadlines | Organisations placed on the list in 2025 apply the basic measures within eighteen months (for many, by October 2026). Those added in 2026 have until 31 July 2027. | ACN Determination 379907/2025 and ACN FAQs |
A supplier does not fall under NIS2 just because its client does. It does, however, receive the client’s requirements: questionnaires, contract clauses, documents and sometimes audits. A supplier falls under NIS2 directly if it carries out one of the listed activities, such as managed IT services, and meets the criteria.
NIS2 does not bind San Marino businesses for the work they do within the Republic. It can, however, affect them through what they do in the European Union.
For personal data, San Marino applies Law No. 171 of 21 December 2018, the country’s data protection law. Rules still evolving. The proposal of 20 January 2026 to amend NIS2 (COM(2026) 13) is still under discussion. This box sets out the rules currently in force.
This box is for information only and is not legal advice. How the rules apply to a particular company should be assessed with its own lawyers.
04 · copy the link to this sectionHow we work
Four steps. Before any test, we need written authorisation from whoever has legal authority over the systems.
We sign a non-disclosure agreement (NDA) and agree a written scope covering systems, time windows, contact people and exclusions. Every test requires written authorisation from whoever has legal authority over the systems.
We run tests, review configurations and talk to the people who manage the systems. Anything that could affect production systems is done only at the agreed times.
We propose fixes in order of severity. The retest is agreed with you.
We run exercises and new tests at agreed intervals, or whenever your systems or obligations change.
05 · copy the link to this sectionThe first hours
The contact form is not an emergency channel. In the first hours, general guidance applies, consistent with the guides published by the authorities.
Updated 15 September 2026
06 · copy the link to this sectionArtificial intelligence
An assistant connected to your email, document archive or ERP reads text, and text can contain orders. An email or an attachment can persuade it to ignore its rules. This is called prompt injection. OWASP’s list of the best-known risks for these systems puts it first. The top ten also include an agent with more autonomy than it needs (excessive agency).
Security testing of assistants that read company data checks four things. In Company Brain projects (the company’s own searchable memory) and AI agent projects, these checks are done before go-live.
07 · copy the link to this sectionPrinciples
In security, what counts is what you can prove on a given date, not what you claim.
08 · copy the link to this sectionSetting an example
Anyone who sells security must apply it to themselves as well.
Updated 16 September 2026
You can check this with your browser’s developer tools.
09 · copy the link to this sectionFrequently asked questions
10 · copy the link to this sectionObservatory
Analysis, guides and ‘first hours’ briefings on company security from the Strategic editorial team.
Encrypted files and a ransom demand. The technical moves for the first four hours, from isolating systems to protecting the backups, from evidence to sizing up the damage, through to the most delicate choice of all, the ransom.
30 August 2026The price of a penetration test depends on scope, approach, manual work, documentation and retesting. How to read a quote, what the rules require and what should be left once the test is over.
22 July 2026Many intrusions leave traces outside the company before they show any sign inside: credentials for sale, domains imitating the brand, suppliers that have been hit. Which signals to check and what to do when they appear.
5 August 2026There are already campaigns in which an artificial intelligence agent did most of the attacker’s work. What it really speeds up, which containment steps can kick in on their own and which must stay with a person.
29 July 2026The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.
11 · copy the link to this sectionContact
A few lines are enough: what kind of company you are, what needs testing or what has happened, and any deadlines. We reply by email, usually within two working days.
Please do not put credentials, IP addresses or vulnerability details in the form. We exchange them later, over the channels we agree. If an incident is in progress, see The first hours for initial guidance.
Or write to us:WhatsAppstaff@strategic.sm
On WhatsApp, messages are answered by Strategic’s AI assistant. Please do not use it for confidential information.
