What an audit must look at beyond the technical layer — and what a failure costs in France, Belgium, Switzerland and Luxembourg

A technical audit finds vulnerabilities. What actually stops a ten-person company, however, is almost never a vulnerability: it is a backup nobody has ever restored, a payment sent to bank details changed by email, a provider who alone holds the admin passwords, or an alert nobody has read for eighteen months.

This article lists the ten domains that purely technical audits leave out, then what a failure really costs in the four countries where we operate — France, Belgium, Switzerland, Luxembourg. The controls are gathered in a free 93-question self-audit, with no sign-up and no collection: the answers stay in your browser.

The ten domains a technical audit leaves out

1. Email security and payment fraud

Risk: diverted payments, identity spoofing, compromised accounts. The controls that matter: SPF, DKIM and DMARC published on the domain; attachment and link filtering; monitoring of unusual sign-ins and auto-forwarding rules to external addresses; protection of admin account recovery options; and an independent verification procedure before any payment or change of bank details.

Warning sign: a change of bank details can be approved on the strength of an email alone, with no callback to a number known in advance. That is the CEO-fraud and supplier-fraud scenario, and it demands no technical skill from the attacker — only a credible identity, which generative AI makes trivial.

2. Network and remote access

Risk: intrusion, then unobstructed spread. You need to know which services are reachable from the internet, close exposed admin interfaces and remote desktops, separate guest Wi-Fi from the internal network, and give providers individual access that is time-limited and revocable.

Warning sign: a provider holds permanent access to the whole network, with no control and no audit trail.

3. Privileges and administrator accounts

Risk: full takeover of the information system. An administrator works from a standard account and switches to a dedicated one for sensitive operations; each employee holds only the rights their role requires; the technical accounts of applications and automations have limited rights; technical passwords, SSH keys and API tokens live in a vault, not in a shared file or a code repository.

Warning sign: every employee holds local administrator rights, with no justification.

4. Business continuity and recovery

This control complements the backup one rather than repeating it: having copies is not enough if the company does not know how to restart. Are the critical applications identified? What happens if the internet, the phone system, the main server or the management software goes down? How long can the business run without that service, and how much data can it afford to lose? Those two numbers — acceptable downtime and acceptable loss — drive the rest of the plan, budget included.

A concrete case: a ten-person company loses its file server. Does it resume essential operations the same day, or wait several days? In most audits we run, the answer does not exist — it gets discovered on the day of the outage. The 3-2-1 rule settles the first half of the problem, not the second.

5. Monitoring, detection and logging

Risk: an intrusion stays invisible until the damage becomes visible. Being alerted when a service goes down, detecting unusual sign-ins and repeated authentication attempts, centralising logs, keeping them long enough to reconstruct an incident, and naming the person who handles alerts.

Warning sign: the company owns security tools, but nobody reads the alerts they produce. An alert with no recipient does not exist — which is the whole point of hybrid SOC monitoring rather than one more tool.

6. Control over providers and dependencies

Risk: dependence on a single provider, loss of access, inability to get your data back. Do the admin accounts for the domain name, hosting and email belong to the company? Can you revoke an access without depending on the party you are revoking? Are essential configurations documented internally? Could you migrate elsewhere, and recover access if your provider disappeared?

Warning sign: the IT provider is the only one who knows the admin passwords, and the domain name is registered in their name. The question is not their competence, it is your ability to leave — and, for the domain name, ownership itself.

7. Costs and IT assets

Risk: wasted spend, forced renewals, misdirected investment. The inventory of software and subscriptions, licences still billed for people who left, hosting costs tracked, automatic renewals recorded, functional duplicates, the hardware renewal plan.

Warning sign: the director knows neither the total of their IT spend nor the list of tools it pays for. This domain is not security: it funds security. The money recovered from duplicates usually pays for upgrading the five most urgent points.

8. Data protection and cloud control

Risk: leakage, loss of control, accidental exposure. Knowing where customer files, HR documents, contracts and financial data are; limiting external share links in time and to the people concerned; attaching storage to business accounts; separating sensitive folders from spaces open to everyone; encrypting in transit and at rest; and keeping essential documents available even if a provider becomes unavailable.

9. AI governance and security

Risk: disclosure of confidential information, wrong decisions, uncontrolled automations. Are the real uses inventoried? Does a written rule state what is never handed to an assistant? Do agents hold limited rights? Do sensitive actions — payments, deletions, external messages — go through human validation? Are important decisions logged, and is there a way to stop an automation that goes off the rails?

Warning sign: an AI agent can change business data or write to customers with no limit on its rights and no suitable control. For an SME the aim is not to ban AI but to use it with simple rules and clear accountability — the subject of governing shadow AI and of monitoring agents in production.

10. Incident response and readiness

Risk: an attack turns into a crisis for want of knowing what to do. Who to contact, who decides on emergency measures including at night, how to isolate a machine without making things worse, how to preserve evidence, where the provider and insurer contact details are — outside the information system, since it may be unreachable — and which notification obligations apply to your country and activity.

Warning sign: faced with ransomware, nobody knows whether to cut the network, call the provider or notify the insurer.

What a failure costs: France, Belgium, Luxembourg, Switzerland

The four countries are not at the same stage, and the gap comes not from the obligations — they look alike — but from when they took effect. Belgium has applied NIS2 since October 2024, Luxembourg since May 2026, France has not transposed it yet, and Switzerland follows an entirely different logic. Figures and dates checked on 30 October 2026.

France

GDPR already applies and is already enforced; NIS2 is not transposed yet, but its requirements arrive through customers.

As of 30 October 2026 the "resilience" bill has not been voted: it was pulled from the Assembly’s agenda on 6 October 2026, and the European Commission opened litigation against France over the delay. No NIS2 penalty can therefore hit a French entity today — which is true of the law only, not of the security clauses large accounts already impose on their suppliers.

Sources : ANSSI — La directive NIS 2 · CNIL — Les sanctions prononcées

Belgium

NIS2 has been in force since 18 October 2024: the obligations and the fines already apply.

The CCB states publicly that its goal is not to penalise every non-compliant entity: it notifies its intention, gives reasons, and weighs the severity and duration of the breach. The CyberFundamentals (CyFun) framework serves as the evidence baseline, and any measure can be challenged before the Council of State.

Sources : CCB — Mesures administratives et amendes sous NIS2 · CCB — NIS2 : ce que cela signifie pour mon organisation

Luxembourg

The NIS 2 law of 5 May 2026 is in force, with the ILR as authority and a registration deadline already past.

Thresholds announced by the ILR: essential entity from 250 staff, or €50M turnover, or €43M balance sheet in Annex I sectors; important entity from 50 staff, or €10M turnover or balance sheet. The financial sector additionally falls under the CSSF and DORA.

Sources : Gouvernement luxembourgeois — l’ILR présente la loi NIS 2 · ILR — simulateur d’applicabilité NIS 2

Switzerland

No NIS2, but a 24-hour reporting duty for critical infrastructure, and criminal penalties aimed at individuals rather than the company.

The difference in nature matters: GDPR hits the company’s wallet, Swiss data protection law opens criminal proceedings against a person — the director or the designated officer. The cap looks lower; the personal consequence is heavier.

Sources : OFCS — Obligation de signaler les cyberattaques · PFPDT — Annonce des violations de la sécurité des données

What those figures do not say

The caps impress and mislead. For an SME, three lines weigh more than the fine:

• The days of downtime. A company unable to invoice, deliver or pay for five days has already lost more than a simplified penalty would cost. That cost does not depend on the regulator: it depends on the quality of your backups and your recovery plan.
• Your customers' clauses. This is the channel through which regulation actually reaches small organisations: an entity in scope of NIS2 must manage its suppliers' risk, and passes it on through questionnaires and contract clauses. That is the cascade effect, and it depends on no parliamentary vote.
• What you cannot prove. After an incident the question is not "were you secure?" but "can you show it?". With no retained logs, no dated restore test, no contract setting out the provider’s obligations, good faith cannot be demonstrated — not to an authority, and not to an insurer.

One last point, often missed: in Switzerland the penalty targets the person. A CHF 250,000 cap imposed on a director is not comparable to an administrative fine absorbed by a company.

Where to start, in order

1. A real, timed restore. Not a look at the backup console: a file brought back, and the time written down.
2. Multi-factor authentication on email and remote access. One working day, and nearly every stolen-password attack stops working.
3. The two-channel rule on any change of bank details. Written down, known, applied without exception — including when the request appears to come from the boss.
4. Taking back ownership of the accounts for the domain, hosting and email, in the company’s name.
5. A one-page incident sheet, printed: who to call, who decides, what not to do under any circumstances.

Those five actions need no investment budget and no project: they need a decision. The rest — segmentation, centralised logging, AI governance — is planned afterwards, and that is the point at which an infrastructure you control costs less than an accumulation of tools.

Taking stock in twenty minutes

The 93 questions in this article, together with those of the five technical domains that precede them, are gathered in our security and resilience self-audit. It returns a score per domain, your five priorities ranked by weight, a count of your blind spots — the controls whose state is unknown, which are an audit’s first real finding — and the regime applicable to your country. Free, no sign-up, no backend: your answers never leave your browser, and nothing reaches us unless you send us your report yourself.

A declared self-audit proves nothing and replaces neither an audit nor legal advice. It serves to know where to look — which is already half the work.

Sources

• ANSSI — The NIS 2 directive
• Centre for Cybersecurity Belgium — Administrative measures and fines under NIS2
• Luxembourg government — The ILR presents the new NIS 2 law
• OFCS / NCSC — Reporting cyberattacks mandatory from 1 April 2025
• CNIL — Penalties issued