Frequently asked questions Page 25 of 27

Frequently asked questions — page 25

• What does the IT consulting service for the public sector and government bodies include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of the public sector and government bodies.
• What does the IT outsourcing service for multi-site companies include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of multi-site companies.
• What does IT outsourcing for companies include for Multi-site businesses?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Multi-site businesses.
• What does Cloud, Microsoft 365 & Azure services include for Multinationals (ES / PT)?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Multinationals (ES / PT).
• What do the cloud, Microsoft 365 and Azure services for education and training organisations include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of education and training organisations.
• What does Smart physical security · Verkada include for Public Sector & Administrations?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Public Sector & Administrations.
• What does cybersecurity include for renewable energy organisations?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of renewable energy organisations in Portugal and Spain.
• What does Managed IT services & support include for Retail?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Retail.
• What do managed IT services and maintenance include for multi-site businesses?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of multi-site businesses.
• What does smart physical security with Verkada include for logistics and transport businesses?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of logistics and transport businesses.
• What does cybersecurity include for healthcare organisations and clinics?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of healthcare organisations and clinics.
• What does IT outsourcing for companies include for Multinationals (ES / PT)?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Multinationals (ES / PT).
• What does Smart physical security · Verkada include for Retail?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Retail.
• What does smart physical security with Verkada include for the public sector and public administrations?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of the public sector and public administrations.
• What does the cloud, Microsoft 365 and Azure service include for professional services?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of professional services firms.
• What does Smart physical security · Verkada include for Logistics & Transport?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Logistics & Transport.
• What does business IT consulting include for financial services and fintech?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of financial services and fintech companies.
• What does business IT consulting include for the public sector and public administrations?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of the public sector and public administrations.
• What does the infrastructure, networks and Wi-Fi service for retail businesses include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of retail businesses.
• What does business cybersecurity include for the public sector and public administrations?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of the public sector and public administrations.
• What does the cybersecurity service for industrial and manufacturing companies include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of industrial and manufacturing companies.
• What does the cybersecurity service for the public sector and government bodies include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of the public sector and government bodies.
• What does Digital Evolution include for Retail?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Retail.
• How are the service results measured?

  Indicators are agreed for availability, incidents, response and resolution times, completed changes, open risks and recovery tests, aligned with the priorities of renewable energy organisations in Portugal and Spain.
• What does Infrastructure, networks & WiFi include for Retail?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Retail.
• What does Digital Evolution include for retail in Portugal?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of retail businesses in Portugal.
• What does the infrastructure, networks and Wi-Fi service for industrial and manufacturing companies include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of industrial and manufacturing companies.
• What does the infrastructure, networks and Wi-Fi service for logistics and transport companies include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of logistics and transport companies.
• What does business cybersecurity include for healthcare and clinics in Portugal?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of healthcare providers and clinics in Portugal, taking GDPR, NIS2 and HL7 into account.
• What does the smart physical security service with Verkada for retail businesses include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of retail businesses.
• What do managed IT services and maintenance include for retail in Portugal?

  They include assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of retail businesses in Portugal.
• How is the outcome of the service measured?

  Measures cover availability, incidents, response and resolution time, completed changes, open risks and recovery tests, adjusted to the priorities of multinationals operating in Spain and Portugal.
• What does the cloud, Microsoft 365 and Azure service include for education and training?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of education and training organisations.
• What does IT consulting for companies include for Financial Services & Fintech?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Financial Services & Fintech.
• What does Digital Evolution include for Manufacturing & Industry?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Manufacturing & Industry.
• Can it be integrated with an internal IT team?

  Yes. A responsibility and escalation matrix is defined so that the internal team, Impulso Tecnológico and other suppliers work within clear boundaries without duplicating tasks.
• What does IT outsourcing include for multinationals with a presence in Spain and Portugal?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope is agreed according to the critical processes, existing systems, owners, risks and measurable objectives of multinationals operating in Spain and Portugal.
• Can the service work with an internal IT team?

  Yes. A responsibility and escalation matrix gives the internal team, Impulso Tecnológico and other suppliers clear boundaries and avoids duplicated or unowned tasks.
• What does Managed IT services & support include for Multi-site businesses?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Multi-site businesses.
• What does the digital evolution service for industrial and manufacturing companies include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of industrial and manufacturing companies.
• What does Cloud, Microsoft 365 & Azure services include for Education & Training?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Education & Training.
• What does the digital evolution service for retail businesses include?

  It includes assessment, prioritisation, implementation and documented operation. The specific scope is agreed based on the critical processes, existing systems, owners, risks and measurable objectives of retail businesses.
• What does Cybersecurity for companies include for Manufacturing & Industry?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Manufacturing & Industry.
• What does Cybersecurity for companies include for Public Sector & Administrations?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Public Sector & Administrations.
• What does Managed IT services & support include for Logistics & Transport?

  It includes assessment, prioritisation, delivery and documented operations. The exact scope follows the critical processes, existing systems, owners, risks and measurable objectives of Logistics & Transport.
• What information is needed to request a dispatch?

  Send the site address, local contact, task and expected outcome, preferred window, equipment details, access requirements, runbook, tools or parts needed and closure evidence. We will identify any missing information before confirming the assignment.
• What is included in a smart-hands visit?

  Typical tasks include rack-and-stack, patching, cable tracing, labelling, visual checks, power-cycle or console actions, basic connectivity checks and permitted photographic evidence. We validate the runbook and escalation path before the visit.
• Can you work in offices and data centres?

  Yes, subject to the site's access, safety and authorisation requirements. Before assignment we confirm contacts, induction, approved tools, change controls and the evidence permitted at that location.
• Where do you provide IT field services and smart hands?

  Our own team is based in Madrid; elsewhere in Spain and Portugal we assign the closest suitable local resource or available partner and confirm location, resource, timing, scope and access for every request.
• Do you guarantee a national response time or keep spare parts?

  No blanket national response time, availability or spare-parts commitment is published. We confirm the service window, assigned resource, travel, site access and any required parts for each accepted request.
• What do IMAC services cover?

  IMAC covers installations, moves, additions and changes. It can include workplace moves, device refreshes, onboarding waves, migrations and multi-site rollouts performed under an approved checklist with asset and outcome reporting.
• Can the consulting roadmap lead to an implementation project?

  Yes. The diagnosis can remain an independent advisory engagement or lead to a separately scoped implementation. Any implementation has its own responsibilities, budget, dependencies and acceptance criteria.
• Is on-site consulting in Valencia guaranteed?

  No blanket on-site availability is promised. Our own team is based in Madrid; when an on-site activity is useful, we confirm the suitable local resource or available partner, location, timing, scope and access for that request.
• What should we prepare before the first consulting session?

  Share the decision you need to make, business goals, stakeholders, systems and suppliers in scope, known incidents or risks, budget constraints and any relevant deadline. Existing diagrams, contracts and reports are useful but not mandatory.
• Do you install Windows and Linux servers?

  Yes. We install Windows Server and Linux, plus virtualised environments with Hyper-V or VMware when required. The choice depends on applications, licences, internal skills and maintenance needs.
• Can you replace an old server without stopping the company?

  In many cases downtime can be reduced to a controlled window. We review dependencies, prior backup, the new environment, acceptance tests and rollback before cutover.
• Are backups included?

  The project can include backup design, configuration, retention and an initial restore test. Scope, RPO and RTO are agreed before production.
• Can you maintain the server afterwards?

  Yes. Maintenance can include monitoring, patching, event review, backup checks and support within the accepted coverage and SLA objectives.
• How are risks reduced during a change?

  Each change identifies prerequisites, an owner, a window, the prior state or backup, acceptance tests and rollback. When impact warrants it, validation starts with a representative site, system or group.
• What is reviewed before scoping an IT project for manufacturing and industry?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For manufacturing and industry, we also document OT/IT dependencies, plant continuity and controlled change. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for the public sector?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For the public sector, we also document traceability, procurement, accessibility and security. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for renewable energy?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For renewable energy, we also document remote connectivity, OT/IT separation and asset continuity. Scope and objectives are confirmed from that evidence.
• How is work coordinated with the internal team and other vendors?

  A responsibility matrix states who approves, performs, validates and receives each task. Carrier, vendor or software dependencies are recorded before dates are set, and handover includes decisions, results and open items.
• What is reviewed before scoping an IT project for pharma and the pharmaceutical industry?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For pharma and the pharmaceutical industry, we also document validation, change control and documented continuity. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for logistics and transport?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For logistics and transport, we also document TMS/WMS, warehouse connectivity and operational traceability. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for retail?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For retail, we also document POS, store connectivity, openings and physical security. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for multi-site businesses?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For multi-site businesses, we also document common standards, inventory, support and site rollouts. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for professional services?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For professional services, we also document confidentiality, document collaboration and Microsoft 365 governance. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for financial services and fintech?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For financial services and fintech, we also document resilience, control evidence and third-party management. Scope and objectives are confirmed from that evidence.
• What is reviewed before scoping an IT project for multinationals in Spain and Portugal?

  We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For multinationals in Spain and Portugal, we also document global IT coordination, local execution and consistent reporting. Scope and objectives are confirmed from that evidence.
• How is risk reduced during a change?

  Each change identifies prerequisites, an owner, a window, prior state, acceptance tests and rollback. When impact warrants it, validation starts with a representative site, system or group.
• How is work coordinated with other vendors?

  A responsibility matrix states who approves, performs, validates and receives each task. Carrier, vendor and software dependencies are recorded before dates are set, and handover includes results and open items.
• What is reviewed before scoping an IT project for education and training?

  We review students, staff, classrooms, learning platform, devices, Wi-Fi and academic applications, as well as locations, owners, dependencies, access and windows. Scope is confirmed from that evidence and the agreed priorities.
• Which metrics and evidence are useful?

  It depends on the objective. For pharma and the pharmaceutical industry, useful evidence may include approvals, changes, restoration, exceptions and outstanding actions, alongside measured availability, incidents, backups, recovery and acceptance. Each metric retains its source and period.
• What is reviewed before scoping an IT project for healthcare and clinics?

  We review HIS, RIS-PACS, laboratory, clinical endpoints, identity and connected medical devices, as well as locations, owners, dependencies, access and windows. Scope is confirmed from that evidence and the agreed priorities.
• Which evidence should be prepared before scoping Microsoft 365 for education?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping industrial digital evolution?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping networks and Wi-Fi for logistics?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping multi-site managed IT services?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping industrial IT/OT cybersecurity?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping public-sector IT consulting and ENS?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping physical security for logistics?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping managed IT services for retail?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping retail digital evolution?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping public-sector cybersecurity?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping physical security for public buildings?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence lets scope, priorities, acceptance and any on-site work be confirmed without turning an assumption into a promise.
• Which evidence should be prepared before scoping IT outsourcing for multinationals?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping financial-services IT consulting?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping retail networks and Wi-Fi?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping healthcare cybersecurity?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping physical security for retail?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping multi-site IT outsourcing?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping managed IT for healthcare?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping Microsoft 365 for professional services?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• Which evidence should be prepared before scoping renewable-energy cybersecurity?

  Prepare inventory, owners, dependencies, incidents, contracts, constraints and test results. That evidence confirms scope, priorities, acceptance and any on-site work without turning an assumption into a promise.
• What fines exist and is management liable?

  For very serious infringements, up to EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important ones. Members of management bodies can be liable for wilful misconduct or gross negligence. For 12 months after entry into force a waiver of fines can be requested, but it is not automatic (art. 65).
• If my company is not in scope, do I have to do anything?

  You do not have the regime's duties, but a customer in scope must manage the security of its suppliers and may ask you for clauses and evidence. A file with policies, multi-factor authentication, tested backups and an incident log helps; a certification such as ISO 27001 helps too, but it is not mandatory.
• What is MyCiber and do I have to register?

  It is the CNCS platform for self-identification, communications and incident reporting. Anyone who may be in scope fills in the form and the CNCS decides the qualification. The deadline is 30 days for new entities and 60 days after the platform was made available for existing ones; the CNCS coordinator mentioned 60 working days.
• How much does certification cost?

  It depends on scope, category or risk, starting maturity, internal effort and the certification body. We do not give figures: it is worked out case by case once the scope is defined.
• Does ISO 27001 count instead of the ENS in a public tender?

  Not as an automatic substitute. If the tender requires the ENS declaration or certificate of conformity, you need that. ISO 27001 can bring maturity and reusable work, but what is accepted is defined by the tender.