What clients ask us most.

Frequently asked questions

• What is a managed IT service and what does it include?

  A managed IT service can cover the agreed technology operation: helpdesk, monitoring, cybersecurity, backups, vendor management and remote or request-scoped site support. At Impulso, the accepted contract defines scope, pricing, exclusions, service window and response objectives.
• How much does a managed IT service cost for a Spanish SME?

  Price depends on users, sites, coverage, SLA objectives, security, tools and transition. After reviewing the environment, we provide a proposal with scope, inclusions and commercial terms.
• What is NIS2 and which companies does it affect?

  NIS2 is the EU cybersecurity directive for entities in essential or important sectors. Applicability depends on sector, size and the exceptions in the directive and national transposition; legal scope should be confirmed before defining the technical plan.
• What is the Spanish National Security Scheme (ENS) and when is it mandatory?

  ENS governs security for systems within its scope. For private providers it may apply to systems used to deliver services or solutions to Spanish public entities when required by the contract and article 2 of Royal Decree 311/2022. Scope and category must be confirmed case by case.
• What should I do if my company is hit by ransomware?

  Isolate affected systems without destroying evidence, activate the response plan and contact specialists. If a personal-data breach is likely to risk people’s rights and freedoms, the controller must notify the authority without undue delay and, where feasible, within 72 hours of becoming aware. Response, recovery and reporting depend on the accepted scope.
• What is the difference between IT and OT and why segment them?

  IT covers corporate systems and OT industrial operations. Separating them with zones, rules and access controls reduces incident propagation and improves oversight; the design depends on plant assets and requirements.
• How many backups does my company need? (the 3-2-1 rule)

  The 3-2-1 rule proposes three copies, two media types and one off-site copy; immutability and restore testing can strengthen it. Architecture, frequency, retention, RPO and RTO must be agreed and validated for each system.
• What is a virtual CISO and when do I need one?

  A vCISO provides part-time cybersecurity leadership: strategy, risk, policies, metrics and audit coordination. Effort, responsibilities and cadence are agreed according to each organisation’s size, exposure and requirements.
• How do I migrate from Google Workspace to Microsoft 365 without losing email or files?

  A migration requires inventory, right-sized tenant and licences, staged transfer, coexistence or DNS cutover, testing, training and rollback. Tools, window, risks and acceptance criteria are confirmed for each project.
• How do I choose an IT partner in Spain and Portugal with real Iberian coverage?

  Compare the coverage model, the resource assigned to each location, response objectives, applicable credentials and billing. Impulso serves Madrid directly; in Portugal and other locations, the nearest available local resource or partner, timing, scope and access are confirmed for each request.
• What does a managed IT service for a retail chain include?

  It includes per-store monitoring, remote and on-site support, management of POS, network and payment gateway, backups and planned reinforcement for sales campaigns. All under a common SLA and a single point of contact for the whole chain.
• How do you stop a POS outage from halting sales?

  With monitoring that detects POS or connectivity failures before the customer notices, immediate remote support and, when needed, on-site intervention. Any incident that affects the till directly is prioritised.
• Can you provide extended support during sales and campaigns?

  Yes. We plan reinforced cover and extended hours for peak campaigns, sales seasons and openings, so the operation is backed up during the highest-selling moments.
• What does managed IT support for a warehouse cover?

  It covers WMS availability, the warehouse network and WiFi, the fleet of RF handhelds, backups and support aligned to shifts. The goal is that the logistics operation never stops because of a technical incident.
• Do you provide out-of-hours support?

  Yes. The warehouse works in shifts, so support adapts to the real operation, with extended cover and continuous monitoring that detects incidents even when no IT staff are on site.
• How are broken RF handhelds handled?

  We keep a managed fleet with fast replacement: if a handheld fails, it is swapped and reconfigured remotely to minimise the time an operator is without a device. We also monitor the WiFi coverage those handhelds need.
• What does IT maintenance guarantee in a clinic?

  It guarantees the availability of clinical-records software, the appointment calendar and diagnostic equipment during care hours, with proactive monitoring, verified backups and priority support for incidents affecting patient care.
• Is health data protected according to regulation?

  Yes. We apply encryption, access control and secure backups aligned with GDPR and the requirements for special-category data, plus a continuity plan so clinical information is always available and protected.
• What happens if a system goes down mid-consultation?

  Support prioritises care-related incidents above all others. With proactive monitoring, many outages are anticipated, and when they happen we intervene immediately, remotely or on site, to restore the clinical service as fast as possible.
• Why Microsoft 365 for a professional firm?

  Because it centralises documents, email and collaboration with security and mobility. For law, consulting or engineering firms, it allows working on case files from anywhere while keeping client confidentiality with access control and sensitivity labels.
• How is client confidentiality protected?

  With sensitivity labels, access policies per client and matter, MFA and conditional access. Only authorised people reach each file, and sensitive information is classified and protected against leaks.
• Can we migrate without losing current files?

  Yes. We plan the migration of email and documents preserving structure, permissions and history, with a validation phase before cutover so the firm keeps working without interruption or data loss.
• What Microsoft 365 licences does a school need?

  Schools typically use A1 (free, web-based), A3 or A5 education licences depending on needs. We help you choose and correctly apply licences for students, teachers and administrative staff.
• How are minors protected in Teams and OneDrive?

  With tailored protection policies: control over who can contact students, communication supervision, content restrictions and per-year identity management. The setup is tuned to age and the school regulatory framework.
• Is it ready for the first day of term?

  Yes. We set up groups by year and subject, Teams classrooms and access before term starts, so teachers and students find everything working from day one with no last-minute setup.
• How is Microsoft 365 managed across several countries?

  With a centrally governed tenant: federated identities, common security and retention policies and support in Spanish and Portuguese. Each Iberian site operates aligned with group standards while the parent keeps visibility.
• Do you provide support in Spanish and Portuguese?

  Yes. Proximity support is provided in both languages for sites in Spain and Portugal, and reporting to the parent is delivered in English with the KPIs the group needs.
• Can it be aligned with the parent company policies?

  Completely. We harmonise conditional access, security and retention with the group global policy, and consolidate licensing and billing so the corporation has a single view of Iberian operations.
• What should a retail store network look like?

  Segmented: one network for POS and management, separate from guest WiFi, with even coverage across the floor. This protects the till, offers secure guest WiFi and replicates the same standard in every store.
• Does guest WiFi compromise POS security?

  No, if it is properly segmented. We isolate guest WiFi on a separate VLAN with no access to the payment network, so customers can browse without putting the POS or store data at risk.
• How do you speed up opening new stores?

  With a repeatable template network design: the same architecture, hardware and configuration in every opening. That makes setting up a new store network fast, predictable and centrally manageable.
• Why does warehouse WiFi need a special design?

  Because height, metal racking and cold rooms create coverage shadows. It needs a survey for the real geometry of the building and access points with seamless roaming so handhelds do not lose connection between aisles.
• What is seamless roaming and why does it matter for picking?

  It is the handheld ability to move from one access point to another without dropping the session. In picking, it stops the operator losing the network while moving through the warehouse, which is where time is lost and errors happen.
• Do you carry out a coverage survey first?

  Yes. Before deploying we measure coverage against the real geometry of the building —height, racking, cold zones— to size the access points and guarantee there are no blind spots where picking would stop.
• What is IT/OT segmentation and why is it needed?

  It means separating the production network (OT) from the office network (IT). Each has opposite needs —availability versus flexibility— and separating them protects production from office-network incidents and reduces the attack surface.
• Does the network hardware withstand the plant environment?

  We use industrial-grade switching and access points, rated for temperature, dust and vibration. Office hardware does not survive plant conditions, so the OT infrastructure is sized specifically for that environment.
• Do you follow a reference model for industrial networks?

  Yes, the Purdue model, which structures the network in levels from the physical process to management. With industrial firewalls and DMZ zones we control traffic between levels and protect production without isolating it from the business.
• What is the difference between IT outsourcing and managed services?

  IT outsourcing takes on the whole department —technical leadership, decisions and operation— as your external IT. Managed services cover specific areas under SLA. Across sites, outsourcing provides a single technical lead for the whole organisation.
• Will we have a single technical lead?

  Yes. We assign a technical account lead who knows your whole organisation and coordinates the operation across sites, so leadership has a single point of contact instead of managing IT branch by branch.
• Do you provide local presence at each site?

  We combine remote support with scheduled visits and on-site presence when needed. The service catalogue is common to all sites, with centralised standards and reporting for a single view of the organisation.
• Can you execute the IT policies of our international parent?

  We operate with the policies and tools defined by the parent and report in English against the group KPIs. For each site-work request, location, resource, timing, scope and access are confirmed before assignment.
• In which languages do you provide support and reporting?

  Support is provided in Spanish and Portuguese for the Iberian sites, and reporting to the parent is delivered in English. This way local operations stay close and the corporation receives information in its working language.
• Do you act as a liaison with local providers and carriers?

  Yes. We manage the relationship with telecom carriers and local providers on behalf of the parent, so the corporation has a single technical point of contact for everything happening in the peninsula.
• What advantages does Verkada have over traditional video surveillance?

  Verkada removes recorders (DVR/NVR) from each store: cameras store on the device itself and are managed from the cloud. That gives centralised chain-wide visibility, smart search and less hardware to maintain on site.
• Does it help reduce store shrinkage?

  Yes. Smart cameras allow search by person or object and configurable alerts, making it easier to spot shrinkage patterns and review incidents in seconds instead of scrubbing through hours of footage.
• Can I view all stores from a single place?

  Yes. The whole chain is managed from a browser, with role-based access. Leadership can review any store, receive occupancy or incident alerts and grant temporary access to managers without installing anything.
• Which warehouse areas should cameras cover?

  Loading docks, the perimeter, entrances and high-value zones. Combining Verkada cameras with access control protects goods at the points where loss happens most and controls who enters each zone.
• Do the cameras integrate with access control?

  Yes. Verkada brings video and access control together in one platform: each door opening is linked to the footage, so an incident is reviewed with its visual context without having to cross between separate systems.
• How quickly can an incident be reviewed?

  In seconds. With everything in the cloud, it is located by time, camera and place without downloading footage or visiting a physical recorder, which greatly speeds up response to a theft or incident.
• Does Verkada video surveillance meet privacy regulation?

  Yes. We configure retention tuned to regulation, a log of who accesses each recording and privacy policies in line with public-sector requirements, so the surveillance is traceable and auditable.
• Can access to recordings be audited?

  Yes. The platform logs every access to footage, which eases accountability and the audit a public administration requires. Access is granted by role and in a traceable way.
• Is it suitable for municipal buildings and premises?

  Yes. We cover entrances, perimeter and common areas of municipal premises and public centres, with cloud management that simplifies maintenance and allows controlled access for authorised officials.
• What is ENS compliance and who is obliged?

  The National Security Framework (ENS) is mandatory for public administrations and their technology providers. Compliance means categorising systems, analysing risks and applying the required security measures according to their level.
• Where does ENS compliance start?

  With a gap analysis against the ENS and the categorisation of systems by level (basic, medium or high). From there, a prioritised compliance plan is built with technical and organisational measures.
• Do you support the conformity audit?

  Yes. We prepare the evidence, support the conformity declaration or certification and assist continuous improvement, so the administration reaches the audit with documented compliance.
• What does DORA require of a financial entity?

  DORA requires digital operational resilience: ICT risk management, resilience testing, incident management, control of critical technology-provider risk and information sharing. Security alone is not enough: you must prove you can withstand and recover.
• How is technology-provider risk controlled?

  With a register of critical ICT providers, assessment of their risk, DORA-aligned contractual clauses and exit plans. The aim is that dependence on a third party does not compromise the entity’s continuity.
• What is operational resilience testing?

  They are exercises that verify the entity can withstand and recover from severe incidents: continuity tests, cyberattack scenarios and, where required, advanced testing. They serve to demonstrate resilience to the regulator, not just assume it.
• What does Industry 4.0 mean in practice?

  It means connecting the machines and lines you already have with management systems to get real-time production data. It is not about buying new machinery, but giving the factory visibility and traceability so you can decide with data.
• Do we have to replace machinery to digitise the factory?

  Not necessarily. In many cases, data can be captured from existing machines and integrated with the ERP/MES. Digital transformation starts by connecting what is already there before considering investment in new equipment.
• What is OEE and why measure it?

  OEE (overall equipment effectiveness) measures availability, performance and quality of production. Measuring it reveals where capacity is lost and is the basis for continuous improvement and, later, predictive maintenance.
• What is omnichannel in retail?

  It is offering a single experience across physical and online stores: unified stock, a customer recognised in any channel and services such as click-and-collect. Technology connects POS, e-commerce and stock so there are no islands between channels.
• How is stock unified between store and online?

  By integrating POS, e-commerce and stock management into a single view, so availability is the same across all channels and services such as buy-online-collect-or-return-in-store become possible.
• What customer data can I leverage?

  By connecting channels, sales and customer data stop being siloed. That gives a single view that lets you personalise the offer, understand cross-channel behaviour and decide with real information rather than intuition.
• What cybersecurity obligations does a clinic have under NIS2?

  The NIS2 directive classes much of the healthcare sector as essential or important entities, requiring risk management, incident notification within strict deadlines and management accountability. We help meet those obligations with technical measures and a response plan.
• How are clinical records protected against ransomware?

  With EDR/XDR on endpoints, network segmentation, immutable offline backups and a tested response plan. The goal is to prevent mass encryption and, if it happens, recover clinical records without paying ransom and without stopping care.
• Can security be strengthened without disrupting care?

  Yes. We plan changes so they do not affect care hours, prioritising measures that need no downtime and scheduling the rest in low-activity windows. Continuity of patient care is the project’s first constraint.
• How is IT across several sites managed with a single provider?

  We centralise the operation with common endpoint, network and security standards, proactive monitoring across all sites and a single point of contact. Leadership gets unified reporting instead of managing each branch separately.
• Will all sites get the same level of support?

  Yes. We apply common SLAs and homogeneous processes across all branches, so support quality does not depend on the site or on whoever happens to be locally available.
• How are IT costs controlled across multiple sites?

  With predictable pricing, fleet standardisation and coordinated purchasing. Unifying the operation removes duplication between sites and gives leadership cost visibility for the whole organisation, not site by site.
• What is the ENS and why does it affect public cybersecurity?

  The National Security Framework sets the mandatory security measures for public-administration systems according to their level (basic, medium or high). It defines how public information must be protected and is mandatory.
• How is a town council cybersecurity brought into ENS compliance?

  We start from a gap analysis against the ENS, categorise systems and apply the required technical and organisational measures, supporting the conformity declaration or certification and continuous improvement.
• Does the ENS require reporting security incidents?

  Yes. The ENS requires the ability to detect, respond to and report incidents to CCN-CERT according to severity. We implement the monitoring and procedures to detect, contain and notify within the set deadlines.
• What does DORA require regarding cybersecurity?

  DORA requires financial entities to have an ICT risk management framework, resilience testing, incident management and notification, and technology-provider risk control. Cybersecurity must be demonstrable to the regulator, not just declared.
• How is a fintech protected against fraud and attacks?

  With strong authentication, continuous monitoring, API protection and real-time fraud detection, plus incident response. The high value of transactions demands layered defence and permanent vigilance.
• What about cloud-provider dependence under DORA?

  DORA requires registering and assessing critical ICT providers, including specific clauses and having exit plans. We help control that dependence so a third-party failure does not compromise the entity continuity.
• What is IT/OT cybersecurity in a factory?

  It is protecting both management systems (IT) and production systems (OT), which have different priorities. In OT, availability is critical, so segmentation, passive monitoring and access control are applied without stopping the line.
• Does NIS2 apply to industrial companies?

  Many manufacturing companies fall under NIS2 as important or essential entities, with obligations for risk management, incident notification and management accountability. We help cover those requirements across IT and OT environments.
• How is production protected without stopping it?

  With IT/OT segmentation, monitoring that does not interfere with controllers and changes scheduled in maintenance windows. Production continuity is the first constraint: security is added without slowing the factory.
• Why is renewable energy critical infrastructure?

  Because energy generation and distribution are essential services: an attack can affect supply. That is why solar and wind plants and their remote operation require strengthened cybersecurity and often NIS2 compliance.
• How is a power plant SCADA protected?

  With OT-environment segmentation, remote-access control, monitoring specific to industrial protocols and configuration backups. The goal is that remote plant operation does not open a door to attackers.
• Does NIS2 affect energy-sector companies?

  Yes. The energy sector is among the most clearly included in NIS2 as an essential entity, with strict obligations for risk management and incident notification. We help meet them by protecting both IT and OT operations.
• What does a complete IT consulting service include?

  It covers environment diagnostics (assets, performance, vulnerabilities, and licenses), architecture design and roadmap, integration of legacy systems with cloud and SaaS, cybersecurity and continuity, and managed services (MSP) with SLAs. At Impulso Tecnológico, the process goes from diagnosis to managed operations, with measurable deliverables and KPIs at each phase.
• What is the difference between a fixed-scope project and managed services (MSP)?

  A fixed-scope project has scope and deliverables defined—ideal for one-off migrations or audits—but ongoing support is typically not included; each project is scoped and quoted case by case, with no commitment. Managed services (MSP) offer predictable monthly costs through a flat rate per supported device (a fixed price once the number of devices is known), documented SLA objectives, and continuous support, making them ideal for fully or partially outsourcing the IT department. Both models can be combined.
• Do you offer on-site support in Spain and Portugal?

  Impulso Tecnológico provides remote support in Spanish and English. Site work in Spain or Portugal is assessed per request, with location, resource, timing, scope and access confirmed before delivery.
• How is GDPR compliance ensured in an IT consulting project?

  Compliance is built in from the architecture design stage, not added as an afterthought: initial vulnerability analysis, firewall and segmentation with Fortinet, endpoint protection with Sophos, backup and disaster recovery with Veeam, and access control with MFA on Microsoft 365 and Azure. For Iberian operations, security policies are coordinated centrally.
• What information do I need to request an IT consulting proposal?

  It is helpful to prepare a description of the current environment (locations, users, main systems), the project objectives, known constraints (budget, timelines, regulations), and success criteria (KPIs). With that foundation, the initial assessment is realistic and the proposal is tailored to your organization.
• What does the installation service include: design, assembly, and programming of the access control system?

  An access control system installer typically covers preliminary assessment, physical installation, enabling cabling, control configuration, and commissioning. Scenario-based verifications and adjustments should also be carried out to ensure proper operation.
• Can card readers and biometric (fingerprint) readers be installed for areas requiring higher security?

  Yes, combining identification methods based on risk level is common practice. The installer determines which reader is appropriate for each entry point and configures differentiated permissions by profiles and areas.
• How are different access profiles managed for employees and visitors, with area-based permissions?

  Profiles are created with permissions by zone and, where applicable, by schedule. The system allows enabling access for staff and visitors with clear rules to reduce unauthorized access.
• Does the system allow monitoring entries and exits and using it as an attendance control system?

  Depending on the scope, the system can log entry/exit events and enable access rules. For attendance control, the scheduling logic and traceability are configured according to the client's management model.
• Do you offer preventive and corrective maintenance, and how are operational protocols managed?

  Preventive maintenance is carried out according to manufacturer recommendations and the agreed scope. Corrective maintenance addresses incidents and restores operability, supported by verification procedures and records of actions taken.
• What should I ask an access control installer before signing a contract?

  Ask for a written scope, site survey approach, integration plan, and acceptance testing evidence. Confirm SLAs, support channels, documentation deliverables, and how audit trails and credential workflows will be configured.
• Can an installer integrate access control with our existing visitor management or video surveillance systems?

  A capable installer should map your current platforms, confirm interoperability, and test integrations during commissioning. Request examples of similar integrations and the exact data flows (events, authorisations, and logs).
• Do I need cloud, on-premise, or a hybrid setup—and who should advise on this?

  The installer should explain the trade-offs based on connectivity, operational requirements, and security posture. They should propose an architecture and validate it against your IT and security constraints.
• How do installers handle compliance and privacy requirements for access control?

  They should define data handling for logs and user credentials, align with relevant local requirements, and apply least-privilege access for administrators. Ask how they secure networks, accounts, and audit trail retention.
• What are the main cost drivers for access control system installation in my business?

  Costs typically rise with the number of doors and sites, cabling and network complexity, software licensing or customisations, integration depth, and commissioning/testing effort. Good planning reduces rework and downtime.
• What should I choose between PoE IP cameras and WiFi cameras for a professional installation?

  PoE typically offers greater stability, fewer interferences, and more predictable maintenance by centralizing power and data. WiFi can be useful when cabling is not available, but requires evaluating coverage, routing, and potential dropouts.
• Is it necessary to use Cat6 or Cat6A, and why does it affect video surveillance?

  Cat6/Cat6A improves transmission quality and reduces errors on long or noisy links. This impacts the stability of the video stream and the reliability of the connection during operation.
• How is moisture protection ensured in outdoor installations?

  This is achieved with appropriate weatherproof enclosures (e.g., IP67), proper sealing of entries and connectors, and cable management that prevents water accumulation. Protecting the connection point is also key.