Frequently asked questions Page 26 of 27

Frequently asked questions — page 26

• Can I start preparing without knowing the Spanish law?

  Yes. The Article 21 measures (policies, incidents, backups, supply chain, MFA, training) are good practice whatever the date of the law, and this guide's 90-day plan is built on them.
• Is the ENS mandatory for a private company?

  Only if it provides services or solutions to public-sector entities, and it applies to the systems involved (Art. 2(3) of Royal Decree 311/2022). The tender or contract will state the declaration or certification required.
• Does my SME have to comply with NIS2?

  As a rule, only if your sector is listed in Annex I or II and the company is at least medium-sized, with an establishment in Portugal. With fewer than 50 people and up to EUR 10 million of turnover or balance sheet, it is usually small and falls outside, apart from the exceptions in art. 3, such as public electronic communications.
• Is NIS2 in force in Spain?

  The directive is in force in the EU, but Spain has not published the law that transposes it and the deadline ended on 17-10-2024. At 15-10-2026 the text remains a draft and the Cortes have been dissolved since 6-10-2026. In the meantime the earlier regime (RDL 12/2018) applies.
• Can an SME hold both the ENS and ISO 27001?

  Yes. They are different but compatible frameworks and overlap in much of the work (policy, risks, applicability, incidents, continuity). Define the scopes clearly so you do not certify more than necessary.
• Who is accountable if the company fails to comply?

  The directive provides that management bodies approve the measures, oversee them and can be held liable for non-compliance (Art. 20), with maximum fines of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities, and EUR 7 million or 1.4%, whichever is higher, for important ones. The final amounts will depend on national law.
• What is the difference between a declaration and a certificate of conformity with the ENS?

  BASIC-category systems only require a self-assessment to declare conformity, although they may undergo a certification audit; MEDIUM or HIGH systems require an audit to certify conformity (Art. 38).
• How often is the ENS audited?

  At least every two years, and on an extraordinary basis if there are substantial changes to the systems (Art. 31). For ISO 27001 the review cycle is set by the certification body.
• How quickly do I have to report an incident?

  Initial notification within 24 hours of concluding that a significant incident exists, an update within 72 hours where needed, notification of the end of the impact within 24 hours, and a final report within 30 working days after that (arts. 42 to 44). If there is a personal data breach, the GDPR may require notifying the CNPD within 72 hours.
• Does a micro or small enterprise have to comply with NIS2?

  As a rule no, because the directive targets medium-sized and large entities in the sectors of Annexes I and II. Small means fewer than 50 people and up to EUR 10 million turnover or balance sheet: headcount alone does not decide. There are exceptions by type of service (for example DNS or public electronic communications), and you may receive requirements by contract as a supplier of a covered entity.
• What incident reporting deadlines does NIS2 set?

  An early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after that notification (Art. 23(4)). Where personal data is involved, the GDPR adds its own notification to the data protection authority.
• Is NIS2 already in force in Portugal?

  Yes. Decree-Law No 125/2025 has been in force since 3 April 2026 and the CNCS Regulation No 756/2026 since 23 June 2026. Some obligations, such as the specific cybersecurity measures, the supply chain and the annual report, only take effect 24 months after the implementing regulation is published (art. 10(2) of the decree-law).
• Do ENS or ISO 27001 satisfy NIS2?

  They help, but they are not equivalent: a certification attests a management system over a specific scope, whereas NIS2 also requires incident reporting and management accountability. Any equivalence will depend on the Spanish law. We compare them in our guide to ENS and ISO 27001.
• Which licence does an SME need for Microsoft Copilot?

  Organisations with up to 300 users can add Microsoft Copilot Business to Microsoft 365 Business Basic, Standard or Premium, Apps for Business or Teams Essentials, with an annual commitment. Above 300 users, enterprise licensing applies.
• How long does it take to build a continuity plan?

  For an SME with few critical processes, the first usable plan usually takes a few weeks. Multi-site companies or those with many suppliers work area by area. What matters is having a tested version early and improving it afterwards.
• What documentation do you hand over at the end?

  Certification reports for every link, a route plan, labelling of cables, trays and fibres, and the port mapping table for each patch panel.
• Is remote access to company computers secure?

  It is when it is properly controlled: a corporate tool, named accounts with MFA for each technician, user consent when working in their session, session logging and access revocation when the service ends.
• What is the difference between a business continuity plan and a disaster recovery plan?

  A business continuity plan covers the whole business: processes, people, sites, suppliers, communication and technology. A disaster recovery plan is its technical part: how, and in what order, IT systems are recovered.
• Can you work white-label for an integrator?

  Yes. The technician can attend on behalf of your company, follow your procedures and closure format, and the commercial relationship with the end customer stays yours. We agree it in writing before the first assignment.
• Do you work outside Madrid?

  Yes. In Madrid with our own team, and elsewhere in Spain and Portugal through local technicians and partners we coordinate, using the same method and documentation.
• How often should the plan be tested?

  At least once a year and whenever systems, suppliers or the organisation change. We recommend alternating tabletop exercises with real technical tests, such as restoring critical systems from backup.
• Does the office need to stop working during the installation?

  Usually not. Cable pulling and splicing are done without cutting the existing network, and moving equipment onto the new link is scheduled in an agreed window, out of hours if necessary.
• Do you install the carrier fibre for internet access?

  No. The carrier installs its own fibre connection to the building and its router. We build the company's private fibre network and can coordinate with the carrier to bring its service to your rack.
• What company size is a fractional CIO for?

  Mainly companies of roughly 20 to 250 employees that depend on technology but cannot justify a full-time IT director, or that have one who needs support with strategy and budgeting.
• Does Microsoft use our data to train its AI?

  According to Microsoft's documentation, prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models.
• Do we need ISO 22301 certification?

  Not necessarily. Certification makes sense when customers or tenders ask for it. We use the ISO 22301 structure as a framework so that, if you decide to certify one day, the groundwork is already done.
• Is Copilot Chat free for businesses?

  Microsoft includes Copilot Chat with eligible Microsoft 365 licences, without buying a Copilot licence. The paid licence adds reasoning over the company's work data through Microsoft Graph.
• How much does a fractional CIO cost?

  It is billed as a monthly fee proportional to the agreed time commitment, usually higher during a transformation project and lower in steady state. We give you a proposal after the initial assessment.
• How long does a business fibre-optic installation take?

  It depends on the distances, whether containment already exists and on permits. A riser backbone through existing containment usually takes a few working days; a link between buildings that needs civil works takes longer. We give a concrete schedule after the site survey.
• Do you work remotely or on site?

  Both. In Madrid we can meet at your offices; with companies elsewhere in Spain and in Portugal we combine remote meetings with site visits when the project needs them.
• What is a vCIO or virtual CIO?

  An external IT director who works for your company a set number of hours or days per month to own IT strategy, budget, suppliers, security governance and reporting to management, without hiring a full-time executive.
• Does a vCIO replace my IT support provider?

  No. The vCIO directs and the provider operates. It works with your current provider or internal team, and if we also provide support we keep both roles clearly separated.
• Do you also implement the backups and recovery technology?

  Yes. Besides writing the plan, we can implement isolated backups, system replication, backup lines and recovery runbooks, and test them with you.
• How long does a Copilot rollout take?

  If Microsoft 365 is in good shape, a pilot can be running within a few weeks. If permissions need fixing or mail and files must be migrated first, that preparation sets the schedule.
• Can we contract remote IT support only?

  Yes, for companies whose incidents are almost always solved remotely. Even so, we recommend defining in the contract the terms for an on-site visit in case hardware must be replaced or the network checked.
• Can Copilot see confidential company information?

  Only what the user can already open. That is why SharePoint, OneDrive and Teams permissions should be reviewed and sensitive information labelled before deployment: Copilot creates no new access, but it makes existing access visible.
• Is a business continuity plan mandatory?

  It depends on your sector and customers. NIS2, Spain's ENS or contracts with financial entities require it in many cases; elsewhere it is not mandatory, but it is the cheapest way to limit the impact of an incident. Confirm with your legal adviser if a regulation applies to you.
• Do you provide resident on-site technicians?

  Yes, when the need is continuous rather than occasional. It is delivered as IT staff outsourcing within our IT outsourcing service, with defined scope, coordination and reporting.
• Single-mode or multimode fibre for an office?

  Inside an office building, OM4 multimode is usually enough and keeps transceivers cheaper. Between buildings or for long runs we recommend OS2 single-mode. We decide with the measured distances and the equipment to be connected.
• How does switching from our current provider work?

  We start with an inventory of devices, access, licences and suppliers, collect credentials and documentation in a controlled way and set a handover date so support is not interrupted.
• How much does IT maintenance cost for a company in Zaragoza?

  It is a monthly fee based on users, devices, servers, sites, support hours and included visits. After a prior study to define the scope, we send a fixed proposal.
• How long does an on-site visit in Zaragoza take?

  It depends on the priority and on what the contract sets out. Included visits, hours and response times are agreed in writing, and many incidents are solved remotely before a visit is needed.
• Do you have technicians in Zaragoza?

  Yes. Day-to-day support is provided remotely by our helpdesk and, when a visit is needed, a local technician in Zaragoza coordinated by us attends, using the same procedure and the same record for every intervention.
• Can you cover warehouses and sites outside the city?

  Yes. We cover warehouses in industrial estates around Zaragoza and sites elsewhere in Aragon and Spain with coordinated local technicians, under one contract and one procedure.
• Do you have your own team in Barcelona?

  Our own team is based in Madrid. In Barcelona, on-site work is carried out by local technicians and partners whom we coordinate and confirm before each visit, depending on location, timing and scope. Assessment, follow-up and much of the support are handled remotely with a single point of contact.
• Can you work with our IT team or current supplier?

  Yes. We often complement the IT manager with specialist tasks, review the work of existing suppliers or coordinate several suppliers under a single plan, with documented responsibilities.
• Do we have to contract every security tool from the start?

  No. The scope should match your risk and operational capacity. Most companies start with identities, critical assets, backup and endpoints, and extend the service later.
• Can you help us with NIS2, ENS or ISO 27001?

  We help implement and document the controls and evidence those frameworks ask for. Whether your company is in scope, and to what extent, has to be reviewed case by case, together with your legal advisers; no provider can guarantee compliance or certification on its own.
• Does the consulting include implementation?

  It can. We can deliver the roadmap projects, oversee the suppliers already working with the company or leave a documented plan for your internal team. We agree this in the proposal so it is clear who is responsible for each phase.
• How much does a cybersecurity company in Barcelona cost?

  It depends on the users and devices protected, the services included and the coverage hours. We prepare a closed proposal after a prior scoping study, with implementation, licences and monthly operation priced separately.
• How much does IT consulting in Barcelona cost?

  It depends on the number of users and sites, the systems included and whether it is a one-off assessment or ongoing support. We do not quote blind: we prepare a fixed proposal after a prior scoping study, separating assessment, implementation, licences and follow-up.
• Can you work with our internal IT team or current provider?

  Yes. We can add specialist capabilities, coordinate rollouts or take over the operation of specific controls, with documented responsibilities. We can also work in English with your group IT or security team.
• Do you carry out cybersecurity audits in Barcelona?

  Yes. We review identities, Microsoft 365, endpoints, network, backups and internet exposure, and deliver prioritised findings with a remediation plan. The initial audit is included when you contract our services; a standalone audit is quoted according to its scope.
• Is there a charge for the initial audit?

  The initial audit is included at no cost when you contract the support or managed services. A standalone, tailored audit with no subsequent contract is quoted according to its scope.
• What is needed to set up a call centre in a company?

  You need to define seats and extensions, queues and distribution rules, opening hours, IVR, call recording if required, supervisor roles and the metrics to be tracked. It is also worth reviewing the network (bandwidth and quality of service for voice), handsets or headsets and the CRM integration. With that information we prepare a fixed quote after the technical visit.
• What is the difference between preventive, corrective and proactive server maintenance?

  Preventive maintenance applies scheduled tasks: patches, event log review, capacity, backups and hardware. Corrective maintenance resolves a specific fault, with root-cause diagnosis and a record of the fix. Proactive maintenance uses monitoring and trends to step in before degradation affects users. A server maintenance plan combines all three.
• What does the IT systems audit report include?

  An executive summary, the scope reviewed, the findings with their evidence, the risk level of each one and an action plan with owners and deadlines. That way management and the IT team know what to fix first and why.
• Is the IT maintenance quote a fixed price?

  Yes. After a preliminary study that defines the scope (devices, users, servers, sites and service level), we deliver a fixed proposal, with no blind pricing. The initial audit is free when you contract the service, and both the first 30-minute call and the quote are free of charge.
• What is checked in an IT equipment audit?

  The inventory of workstations and servers, their hardware and warranty status, the operating system and patches, licences, antivirus or EDR, encryption, backups and administrative access. The findings are set out in the audit report, together with the risks and the improvement priorities.
• Can you work with our internal IT team?

  Yes. The engagement can provide specialist capacity, independent review or governance while the internal team retains operational ownership.
• How is this different from buying ad hoc support hours?

  Ad hoc hours fix isolated tasks. A managed helpdesk measures the service, documents it, learns from recurring incidents and coordinates preventive work. Over the medium term it usually reduces disruption and dependence on specific individuals.
• Do all applications need the same RPO and RTO?

  No. Each system should be classified by impact: sales, invoicing, production, email, files, ERP, CRM or customer service. Applying the same target to everything tends to raise costs without good reason or leave what is truly critical unprotected.
• Can on-site support be included?

  Yes. Many problems are solved remotely, but some environments call for planned visits for the network, workstations, printers, servers or incidents affecting a whole site. Coverage is defined according to criticality, location and actual volume.
• How many options should an IVR have?

  As few as necessary. The usual approach is to start with three or four clear routes and measure whether they work. If the menu grows too large, abandonment rises and callers feel the company is hiding behind its phone system.
• Is the phone system always to blame for missed calls?

  No. Missed calls can be caused by the network, coverage, badly sized queues, internal processes, unclear ownership or peaks in demand. That is why it pays to review data and operations, not just the technical configuration.
• Do projects require an on-site consultant?

  Not always. Workshops and analysis can be remote; physical work is coordinated with the nearest technical resource and local partners when the scope requires it.
• What happens if a threat is detected?

  There must be a procedure: contain the device, assess the scope, check credentials, validate backups, inform those responsible and document the actions taken. Technology helps, but it is the coordination of the service that reduces the impact.
• Doesn't Microsoft 365 already protect email and files?

  Microsoft provides platform availability, but that is not always the same as recovery from deletions, human error, specific retention needs or compliance scenarios. It is worth reviewing which data you need to recover, how quickly and with how much history.
• Does the helpdesk replace the in-house team?

  Not necessarily. It can act as an external first line, as reinforcement for the in-house team or as a complete service for companies without their own IT department. What matters is defining responsibilities, escalation and reporting so that nobody loses visibility.
• Does Verkada need an NVR or a local server?

  The cameras combine on-device storage with management through Verkada Command, so they do not rely on a traditional NVR. The network and connectivity remain an essential part of the design.
• Can you prepare a quote for a site in Madrid?

  Yes. The project quote is finalised after a technical visit to the site, where we review coverage, network, installation, retention, licences and support.
• Can you review an existing supplier contract?

  Yes. We can review scope, responsibilities, service levels, security, continuity, pricing structure and exit provisions alongside the technical evidence.
• Can it be adapted to opening hours or campaigns?

  Yes. A well-maintained IVR can change messages, routes and call forwarding according to opening hours, public holidays, sales campaigns or team availability. What matters is documenting the changes and testing them before they go live.
• Can we start with a pilot?

  Yes. A pilot lets you validate locations, searches, permissions and alerts before rolling out the standard to more areas or sites.
• What is delivered after discovery?

  Typical outputs include the current-state map, risks, decision options, prioritised roadmap, responsibility matrix and acceptance criteria.
• Can the service work with an internal IT manager?

  Yes. A co-managed responsibility matrix can keep strategy and selected systems internal while Impulso provides helpdesk, monitoring or specialist operations.
• What happens during onboarding?

  We agree scope, inventory users and assets, establish controlled access, transfer active issues, configure support and monitoring, then produce a prioritised baseline.
• Do you provide IT services to companies outside Madrid?

  Yes. In Madrid we work with our own team, and in the rest of Spain and in Portugal through local technicians and partners, who follow the same procedures and the same contract documentation. Anything that does not require a physical presence is handled remotely, and we provide remote support to clients in 25 countries. For each request we confirm which resource covers each site.
• How does a migration differ from installing a new phone system?

  An installation starts from scratch. A migration starts from a system that is in service: you need to inventory the current programming, keep the numbering, maintain call handling during the changeover and retire the old system in an orderly way. If you have no existing system, the process is that of a new phone system installation.
• What does a comprehensive IT service for businesses include?

  User support, preventive and corrective maintenance, systems and server administration, networks, Microsoft 365 and cloud, verified backups and cybersecurity, with a single point of contact, SLAs by priority and regular reporting. The exact scope is agreed in writing before we start.
• How long does it take to migrate a phone system to VoIP, and can it be done without dropping calls?

  It depends on the number of extensions, sites and number blocks being ported, and on the state of the network. The migration runs in parallel and in phases: the new system is configured and tested with a pilot group before the numbers are moved, so call handling is not interrupted.
• Can I keep my phone numbers when moving to VoIP or a cloud phone system?

  Usually yes, by porting the numbers to the new carrier. The main and direct-dial numbers are inventoried, we decide which ones to keep, and the porting date is scheduled in a quiet period, with the new system already tested.
• How is the price of IT services for businesses calculated?

  It depends on the number of users and devices, the service level (SLA), the coverage hours, the sites and travel involved, and the areas included (support, maintenance, security, backups, cloud or networks). After a free 30-minute initial call and a preliminary scoping study, we send a fixed proposal. The quote is free of charge.
• What does the price of IT maintenance for a business depend on?

  On five main factors: the number of devices and users, the service level (SLA) by criticality, the coverage hours, travel and sites, and the areas included, such as backups, antivirus/EDR or networks. With that information we prepare a fixed proposal after a preliminary scoping study.
• How is a phone system migration quoted?

  According to the number of extensions and users, the sites and the numbers being ported, the state of the network, the handsets being reused and the complexity of queues, IVR and integrations. A project quote is finalised after a technical visit; requesting one is free of charge.
• How much does IT maintenance cost for a business in Leganés?

  It depends on the number of users and devices, the servers and critical applications, the sites and the response level you need. That is why we do not quote blind: after a preliminary study that defines the scope, we prepare a fixed proposal setting out the SLA and what is included. The first 30-minute call and the quote are free.
• How is IT maintenance quoted for a business in Alcorcón?

  We start with a preliminary study of the environment: users, workstations, servers, network, Microsoft 365, backups and security, as well as the sites and the criticality of each system. With that scope defined, we prepare a fixed proposal detailing the SLA, remote and on-site support and reporting. The quote is free of charge.
• Which business networking solutions does a network security project include?

  It depends on the starting point, but it usually combines next-generation firewalls, VLAN segmentation, corporate Wi-Fi with strong authentication, VPN with MFA for remote access, network access control (NAC) and monitoring with alerts. We begin by reviewing the architecture and the risks and, once the scope is defined, prepare a fixed proposal for implementation and, if needed, ongoing operation.
• What does a network maintenance contract for businesses include?

  Preventive checks of switches, routers, firewalls and access points; firmware and patch updates; configuration backups; monitoring of availability, latency and congestion with alerts; corrective work with agreed response times; review of cabling and Wi-Fi coverage; and regular reports. The scope is set by sites, number of network devices and criticality, and with that information we prepare a fixed proposal.
• What does IT support for businesses in Madrid include, and how is it quoted?

  It includes remote and on-site user support, preventive maintenance of devices and servers, network management, Microsoft 365, backups and security, with priorities and response times agreed in the SLA. The quote is a fixed proposal that we prepare after a preliminary study defining the scope: users, sites, servers and critical applications. The first 30-minute call is free.
• What is not covered by a managed IT service fee?

  Projects (migrations, new networks, server replacement), hardware and licence purchases, application development and support outside the agreed hours, unless extended coverage has been contracted, are normally quoted separately. The contract should state this and explain how such work is approved.
• What does switching from my current IT provider involve?

  It is organised in phases: first, access credentials, inventory, licences and third-party contracts are collected and verified, with an orderly handover if there is an outgoing provider; next, the environment is stabilised (monitoring, verified backups and up-to-date patches); and only then are improvements planned.
• What is the difference between backup frequency and the real RPO?

  Backup frequency is what is scheduled; the real RPO is the point you can actually recover from. If a backup fails and nobody checks the alert, the recovery point becomes the previous valid backup. That is why the RPO is only met if someone checks every day that backups complete successfully.
• How do you prove that the committed RTO is being met?

  With timed recovery tests of the critical systems, at least once a year and after significant changes. The time is measured from when the incident is declared until users are working normally again, and the result is documented along with the problems found and the improvements agreed.
• How much does IT maintenance cost for a company?

  It depends on the number of workstations and servers, the support hours, whether on-site visits are included and the chosen model: flat fee or block of hours. At Impulso Tecnológico we provide a closed proposal after a prior study that defines that scope; we do not publish generic prices because every environment is different.
• What does a flat-fee IT maintenance plan cover?

  A fixed monthly fee for an agreed scope: the devices, servers and users included, remote support, preventive reviews, antivirus and backup management and, if the plan provides for it, on-site visits. Anything excluded, such as projects, hardware or out-of-hours work, should be stated in writing in the contract.
• Which is better: a flat fee or a block of hours?

  A flat fee usually pays off when there are several users, servers or frequent incidents, because the cost is predictable and prevention is included. A block of hours suits small offices with a stable estate and few incidents, although hours are also used up by emergencies and the annual spend is harder to predict.
• What does a managed network service cover, and what is left out?

  It covers the day-to-day operation of the agreed network: monitoring of switches, routers, firewalls and Wi-Fi, alert and incident management, configuration backups, planned firmware updates and routine changes such as new VLANs or access rules. New hardware, cabling extensions and redesigns are usually quoted separately. That boundary should be written into the contract, together with the covered inventory and response times.
• How do I choose a network management solution for my company?

  Start from your inventory and number of sites. Then check that the solution is compatible with the vendors you already use, centralises configurations and alerts in a single console and lets you delegate permissions with traceability. The decisive question is who will operate it: a tool whose alerts nobody handles does not improve the network, which is why many SMEs choose a managed service that includes both the tool and the team that runs it.
• What does server maintenance for businesses in Fuenlabrada include?

  It includes monitoring of critical services, disk space and event logs; planned patching and updates; backup verification with restore tests; hardware checks such as disks, RAID, power supplies and UPS; and incident response, remotely or on site when the fault requires it. The servers covered, the support hours and the response times are set out in the contract.