Paid module · NIS2 Cybersecurity
Sell cybersecurity to the SMEs you already support. With a grade, a plan and a report every month.
The NIS2 Cybersecurity module assesses the security posture of every machine and every client, gives a 0–100 score (grade A to E) organised by the areas of the NIS2 Directive and of the Portuguese CNCS framework (QNRCS), and produces a monthly report under your company's brand. A new recurring service, with no extra tools or spreadsheets.
- €2.00 per machine/year
- Minimum €24.00 per client/year
- Windows and Linux
- Agent 0.2.9 or later
Not a certification: it helps you prepare and evidence measures. Read the note
Clínica Exemplo, Lda
14 machines · 2 servers
Client score: 78 out of 100, Grade B
By NIS2 area (Art. 21(2))
- c) Continuity and backups 88
- e) Maintenance and vulnerabilities 71
- g) Cyber hygiene and training 80
- h) Cryptography 62
- i) Access and assets 76
- j) Multi-factor authentication 55
01 Why now
NIS2 reaches SMEs through their customers' front door.
The NIS2 Directive extends cybersecurity obligations to many more organisations across the EU. Portugal transposes it through its new cybersecurity legal regime, supervised by the CNCS. And even SMEs that are not directly in scope will be asked: essential and important entities must manage the risk of their supply chain.
-
Suppliers get asked too
Clinics, offices, workshops and distributors that work for in-scope organisations are starting to receive security questionnaires and requests for evidence. Those with answers ready keep the contract.
-
The first question goes to whoever looks after their PCs
Your client will ask you for help. With the module, you answer with data from every machine, an action plan and a report — not an opinion.
-
Recurring revenue, not a one-off project
Assessing once is a quote; following up every month is a contract. The monthly score shows progress and justifies your remediation work.
02 What is checked
The controls an auditor asks about, read on every machine.
The MorDitor agent reads the security configuration of every Windows machine at start-up and every 6 hours, with Linux equivalents where they make sense. Each control has a weight and is mapped to the areas of Article 21(2) of the NIS2 Directive and to the QNRCS categories.
-
Network exposure
NIS2 Art. 21(2) (e) · (g)
Windows
- SMBv1 disabled
- Remote Desktop: firewall exposure and Network Level Authentication required
- Firewall on in every profile (domain, private, public)
- AutoRun and AutoPlay disabled
Linux
- SSH: root login and password authentication
- Firewall active
- xrdp exposed
-
Accounts and access
NIS2 Art. 21(2) (i) · (j)
Windows
- Local administrators: who has rights
- Guest account disabled
- User Account Control (UAC)
- Screen lock on inactivity, with password
- Password policy: length, expiry and lockout after failed attempts
Linux
- sudo / wheel administrators and extra uid 0 accounts
- Password and lockout policy (login.defs, pwquality, faillock)
-
Device protection
NIS2 Art. 21(2) (e) · (g)
Windows
- Antivirus / Microsoft Defender on and up to date
- Secure Boot (UEFI)
- TPM present and ready
Linux
- Secure Boot
- TPM
-
Encryption
NIS2 Art. 21(2) (h)
Windows
- BitLocker on the system drive
- Recovery key stored in MorDitor
Linux
- LUKS-encrypted volumes
-
Updates and support
NIS2 Art. 21(2) (e)
Windows
- Pending security updates
- Windows version still supported
Linux
- Pending security updates
- Automatic updates (unattended-upgrades / dnf-automatic)
-
Continuity and backups
NIS2 Art. 21(2) (c)
Windows
- Status of the backups monitored by MorDitor: last success and failures
Linux
- Status of the backups monitored by MorDitor: last success and failures
The list of controls and their weights may evolve with new agent versions; the report always shows what was assessed on each machine.
03 Score and action plan
A grade the business owner understands. A plan the technician follows.
Each machine gets a 0–100 score and a grade from A to E; each client gets an overall score that combines its machines and the organisational questionnaire. The monthly history shows the trend — and the result of your work.
- Weighted controls: an unencrypted drive or an exposed RDP port weighs more than a slow screen lock.
- Action plan sorted by gain: "fix this and the score goes up N points".
- Each action opens the MorDitor tool that fixes it: patching, BitLocker or scripts.
- Views by the areas of NIS2 Art. 21(2) (points (a) to (j)) and by the QNRCS functions: Identify, Protect, Detect, Respond and Recover.
Grades
- A Very good
- B Good
- C Fair
- D Weak
- E Critical
Action plan
PC-RECEPTION-01 · Clínica Exemplo, Lda
Now
64 C
After the plan
90 A
- +9 points
Turn on BitLocker and store the recovery key
Fix with: BitLocker
- +7 points
Close Remote Desktop on the public firewall profile
Fix with: Scripts
- +6 points
Install 4 pending security updates
Fix with: Patching
- +4 points
Disable SMBv1
Fix with: Scripts
04 Questionnaire and evidence
What the agent can't see, the questionnaire records — with proof.
Much of NIS2 is about organisation. For each client, you answer a short questionnaire and attach the evidence. Every piece of evidence has an expiry date: when it expires, the score drops and MorDitor warns you in time to renew it.
-
Tested backups
Date and result of the last restore test.
NIS2 Art. 21(2) (c)
-
MFA on e-mail
Multi-factor authentication on e-mail accounts.
NIS2 Art. 21(2) (j)
-
MFA on remote access
VPN, remote access and admin portals behind a second factor.
NIS2 Art. 21(2) (j)
-
Incident response plan
Who does what, and the CNCS contact for the 24-hour early warning.
NIS2 Art. 21(2) (b)
-
Awareness training
Date of the client staff's last training.
NIS2 Art. 21(2) (g)
-
Access and offboarding
Policy for granting access and revoking it when someone leaves.
NIS2 Art. 21(2) (i)
-
Supplier assessment
Critical suppliers identified and assessed.
NIS2 Art. 21(2) (d)
Evidence
Clínica Exemplo, Lda
-
Restore test — file server
Valid until 31/03/2027
-
Awareness training 2026
Valid until 15/09/2027
-
E-mail MFA policy
Expired on 30/10/2026
The score dropped and the team was notified.
05 Monthly report
A report under your brand, every month, without writing it.
Every month, MorDitor produces each client's "Cybersecurity report" as a PDF, with your company's name and logo: an executive summary for the business owner, technical detail per machine and the action plan.
- One-page executive summary: score, trend and the top three priorities.
- Technical detail per machine and per NIS2 area.
- Evidence pack export (PDF, CSV and a ZIP of the attached files), ready to answer a customer or partner questionnaire.
- Alerts when a client's score drops below the threshold you set or when a critical control fails.
Cybersecurity report
Executive summary
By NIS2 area (Art. 21(2))
- c) Continuity and backups 88
- e) Maintenance and vulnerabilities 71
- g) Cyber hygiene and training 80
- h) Cryptography 62
- i) Access and assets 76
- j) Multi-factor authentication 55
This month's priorities
- Turn on BitLocker on 3 laptops
- Enable e-mail MFA for the whole team
- Renew the restore test evidence
06 Pricing
€2.00 per machine per year.
Bought per client (group), by number of machines: every machine of the client is covered. Minimum €24.00 per client per year (12 machines). More machines mid-term? You only pay for the time left. No trial.
- per machine/year
- €2.00
- minimum per client/year
- €24.00
- on 3 years
- −10 %
- 01
Per machine, in each client
You choose how many machines to cover in each client (group) — at least the ones the client already has and at least 12. Workstations and servers, Windows and Linux.
- 02
More machines, prorated price
To install more machines than you bought, add them mid-term: you only pay for the days left and they all renew on the same date. With every machine in use, installing one more for that client waits until you add machines.
- 03
1 or 3 years
One payment per term, no monthly fees. 3 years get a 10 % discount.
- 04
Bought in the portal
In the portal, under Group → Modules. The module comes on top of the MorDitor licences of the machines.
| Machines in the group | 1 year | 3 years (total, −10 %) | Per machine/month |
|---|---|---|---|
| 5 machines | €24.00 | €64.80 | €0.40 |
| 12 machines | €24.00 | €64.80 | €0.17 |
| 30 machines | €60.00 | €162.00 | €0.17 |
| 100 machines | €200.00 | €540.00 | €0.17 |
- Up to 12 machines, the minimum of €24.00 per year applies (12 machines included).
- Prices in euros, excluding VAT, with the same VAT rules as licences. For 3 years, the price is the total for the 3 years with the discount applied.
Margin example
A client with 15 machines costs you €30.00 per year for the module. If you charge them €29.00/month for a "monthly cybersecurity report" service, you bill €348.00 per year: €318.00 gross margin (91 %) — before the remediation work, which you bill too.
Illustrative example, excluding the machines' MorDitor licences; you decide the price of your service.
During the beta
While MorDitor is in beta, buying modules in the portal may not be open yet. If you want to use the module for a client, talk to us: MORDELABS can activate it on the group.
Important: this is not a certification
The NIS2 Cybersecurity module is not a certification and does not, by itself, guarantee compliance with the NIS2 Directive or with the national law transposing it. It is a tool that helps your company and your clients prepare, apply and evidence cybersecurity risk-management measures.
Each organisation's specific obligations depend on its legal situation and on CNCS guidance. If in doubt, consult a lawyer or an auditor.
07 FAQ
Questions about the NIS2 module.
Is it a NIS2 certification?
No. The module does not certify or guarantee NIS2 compliance. It measures the security posture of machines, records organisational measures with evidence and produces reports that help you prepare audits and answer customer and partner questionnaires.
Which machines are covered?
The machines you buy for the module in that group (client) — workstations and servers, Windows and Linux. Every machine of the client must be covered: the purchase includes at least the ones it already has and, to install more, you add machines mid-term, paying only for the time left. At renewal you choose the number of machines again.
What happens when the subscription expires?
The module's features switch off for that group: no more score, monthly report or module alerts. The data — history, questionnaire and evidence — is kept and comes back when you renew. Regular monitoring continues with the machines' licences.
Does it work on Linux?
Yes. On Linux servers and workstations, the agent checks the equivalent controls: SSH root login and password authentication, firewall, LUKS encryption, automatic updates, sudo administrators, Secure Boot and TPM. Windows-only controls, such as BitLocker or SMBv1, do not apply to Linux machines.
Do I need to update the agent?
Yes: the security controls are read by agent 0.2.9 or later. The agent updates itself with packages signed by the platform; machines on older versions only get a score once they update.
Where are the data and evidence stored?
In MorDitor, on servers in the European Union, like the rest of the platform. Only your team sees them, according to each group’s permissions, and you can export them at any time in the evidence pack.
How do I buy it?
In the portal, open the client's group and go to Modules. Choose 1 or 3 years and the number of machines and see the price. You can also add the module to a licence purchase, under Licences → Buy licences → Add modules. There is no trial.
What about the beta?
During the beta, buying modules in the portal may not be open yet. Talk to us: MORDELABS can activate the module on the groups where you want to use it.
Does my client see MorDitor?
The report carries your company's name and logo. Your client sees your brand and your work.
Do prices include VAT?
No. Prices exclude VAT and follow the same VAT rules as licences.
Turn NIS2 into a monthly service.
Create your account, install the agent on a client's PCs and see the first score — and the plan to raise it.