In Part 1, we discussed why cybersecurity has become a business continuity issue and how Printing International protects its network, endpoints and software environment.

But strong cybersecurity is not built around one technology. It is a combination of prevention, monitoring, updates, backup and recovery — all continuously managed as risks evolve.

In Part 2, we ask Diederik Maes what those building blocks look like in practice and what companies should be paying attention to.

Diederik, if you had to define the essential building blocks of cybersecurity, what would they be?

Diederik Maes:
I would start with a secure network, protected endpoints and up-to-date software. But that’s only the preventive side.

You also need continuous monitoring, reliable backups and a clear recovery strategy.

The key is that these elements work together. Cybersecurity becomes much stronger when you stop looking at individual products and start looking at the complete environment.

Why is backup such an important part of that strategy?

Because no security solution can guarantee that an incident will never happen.

At Printing International, critical data is backed up off-site. There is also a separate backup of the Microsoft 365 environment.

That gives you another layer of protection if data becomes unavailable, corrupted, accidentally deleted or encrypted.

But simply having a backup isn’t enough. The important question is:

Can you actually recover the data you need when you need it?

Many companies assume Microsoft 365 already takes care of that.

That’s a common misconception.

“It’s in the cloud, so it’s backed up” sounds logical, but cloud storage and an independent backup are not the same thing.

Companies need to think beyond where their data is stored and consider how it would actually be recovered after an incident.

That’s why backup and recovery should be part of the cybersecurity strategy from the beginning, not something you think about after something has gone wrong.

NIS2 has also brought much more attention to cybersecurity. What does it mean for companies outside its direct scope?

NIS2 has definitely changed the conversation.

Printing International does not currently fall directly within the scope of NIS2 based on the applicable criteria. But that doesn’t mean cybersecurity requirements stop there.

Companies are connected through customers, suppliers and partners. Organisations subject to NIS2 may increasingly expect their suppliers to demonstrate that they also manage cybersecurity risks responsibly.

So even without a direct legal obligation, good cybersecurity practices are becoming increasingly important within the wider supply chain.

Is compliance enough to say that a company is secure?

No.

Compliance can provide a useful framework, but cybersecurity should never become just a checklist.

The real objective is to reduce risk and make the organisation more resilient.

A company can have policies and documentation in place, but you still need to ask practical questions: Are systems patched? Are alerts monitored? Are backups working? Can data be restored? Does everyone know what to do when an incident occurs?

That’s what ultimately matters.

What is one of the biggest mistakes companies make?

Treating cybersecurity as a project that can be completed.

The digital environment is constantly changing. New vulnerabilities are discovered, software evolves, devices are added and attackers develop new methods.

That’s why cybersecurity requires continuous monitoring, updating and adaptation.

You don’t become secure once. You have to keep working at it.

Why does Printing International choose to work with a long-term IT partner?

A long-term partnership gives us a complete view of the environment.

We know the infrastructure, the systems and how they are connected. That makes it possible to manage network security, endpoints, patching and backups as one environment instead of separate technical components.

It also allows us to work proactively.

Instead of waiting until there is a problem, we can monitor developments, identify risks and advise Printing International when something needs attention.

Your background at Fly By Wire is strongly influenced by aviation. Does that affect this approach?

Absolutely.

In aviation, you work with procedures and checks. You don’t assume something is working correctly — you verify it.

The same principle applies to cybersecurity.

A backup isn’t useful because someone configured it three years ago. You need to know it’s still running and that recovery is possible.

The same goes for firewalls, software updates and endpoint protection.

It’s the difference between assuming you’re protected and knowing that the controls are actually working.

What should companies take away from this?

Don’t start with the question:

“Which cybersecurity product should we buy?”

Start with:

“Where are we vulnerable, what would happen if something went wrong, and how quickly could we recover?”

Then look at the different layers: network, endpoints, patching, monitoring, backup and recovery.

Cybersecurity isn’t about one perfect solution. It’s about building multiple layers that work together.

Strong cybersecurity is built — and continuously maintained

At Printing International, cybersecurity combines network security, SentinelOne endpoint protection, monitoring and patch management through NinjaOne, off-site backup and separate Microsoft 365 backup.

But technology is only part of the equation. The real strength comes from continuously checking, updating and improving those layers as the digital environment changes.

As Diederik puts it:

“Cybersecurity is a continuous process. It’s not a project you finish, but a journey of monitoring, updating and adapting to new risks.”