Internal working copy · scored · English · v3.1 · 7 September 2026

NIS2 Intake Questionnaire

Self-assessment with a local working tally. Q25 is inverted (No = 2). Not a certification and not an official NIS2 score.

Trust & NIS2 URL book
38 / 50
Score / 50
76%
Percent
Established
Readiness band
12 / 12 / 1
Yes / Partial / No

HEA World assessment

HEA World is a solo-founder Netherlands SaaS (NPE Holding B.V., Naarden) selling hosted AI agents. Nicolas Payen is owner, Security/Ops, and the only company operator. Encryption, auth, access isolation, deploy gates, and backup jobs are the strongest engineering evidence. Formal ISMS artefacts — first quarterly review, live restore test, MDM — are still the weak side.

Solo founder How this copy is read. One operator, one company laptop, no security team. Q1, Q6, Q16, Q17, and Q18 are Yes under that reading. Q25 is No and is inverted in the working tally (No = strong / 2 points), because the question asks whether a risk is present.

This is readiness mapping, not ISO 27001 certification and not a completed NIS2 entity assessment. Q5, Q12, Q19, Q22, and Q24 stay Partial on purpose. Q20 is Yes: status page, crons, build gates, and model-error digest.

Applicability: filling this questionnaire does not mean NPE Holding is an essential or important NIS2 entity. That needs legal review.

In place

Still open

Working tally (this file only)

Public evidence index

1

Organisation & policy

1. Formal information security policy

Is there a formal information security policy in the organisation?

YesSolo founder Written information-security policy adopted by Nicolas Payen on 5 September 2026. For a one-person company that is the formal policy. Residual sits in Q5: first quarterly review not held. Not an ISO ISMS.

Public Trust — principles · Trust — compliance roadmap (ISO 27001 not claimed)
Internal information_security_policy.md — adopted 2026-09-05; next review 2026-12-05

2. Cybersecurity at management level

Is cybersecurity discussed structurally at management level?

Yes Founder-led: security is a named critical domain with owner sign-off on design notes and deploys. There is no separate board ISMS cycle — that gap sits in Q5.

Public Trust — secure operational foundation · Security contact
Internal Owner is Security/Ops on every critical-domain change (auth, billing, publish, privacy, cybersecurity)

3. Documented responsibilities

Are IT and security roles and responsibilities clearly recorded?

Partial Owner = Nicolas Payen. Secondary security-intake role is written and unassigned (external / counsel / MSP later). No formal RACI beyond that.

Public Trust — shared responsibility · security.txt
Internal information_security_policy.md §2 Roles; security_vulnerability_intake_note.md

4. IT risk assessment

Are IT and cybersecurity risks actively identified and assessed?

Partial Every material change carries a P0/P1/P2 class plus blast analysis. Public trust page maps the compliance roadmap. No recurring formal risk-assessment paper or legal NIS2-entity classification.

Public Trust — compliance roadmap · NIS2 Directive (EU) 2022/2555 (legal text; not a claim of applicability)
Internal Class B blast analysis on critical-domain changes; no standalone risk register yet

5. Policy & updates

Is the information security policy periodically evaluated and updated?

Partial Adopted policy has a quarterly agenda. First review due 5 December 2026. Not yet held.

Public Trust — compliance roadmap
Internal information_security_policy.md §7 — first review 2026-12-05, not held

2

IT & assets

6. IT asset overview

Is there a current and complete overview of all IT assets?

YesSolo founder Company estate is the public sub-processor list, cloud registers, owner consoles, and one company MacBook Pro. That is the complete company inventory. Second Mac and iPhone are personal and out of scope.

Public Sub-processors · Trust — data & infrastructure
Internal supplier_register.md; device_security_baseline.md (1 company MacBook Pro)

7. Updates & patch management

Are software updates and security patches applied automatically?

Partial Platform patching is on Vercel and Cloudflare. Application dependencies are pinned. No documented automatic endpoint / OS patch programme for the company laptop.

Public Vercel security · Cloudflare Trust Hub · Trust — data & infrastructure
Internal Exact dependency pins + cross-repo sync rule; no MDM patch policy

8. Lifecycle management

Is lifecycle management in place for hardware and software?

Partial Software lifecycle is real (publish / revert, package contract, exact pins). Hardware lifecycle is informal; the company is cloud-first with one owned laptop.

Public Trust — backups, recovery, and rollback · Trust — secure operational foundation
Internal HEA package contract + publish/revert; device_security_baseline.md

9. Critical systems identified

Are business-critical systems and applications clearly identified?

Yes Named critical domains: auth, user access & HEA sharing, billing, metering, transfer/publish, chat engine, foundry, data privacy, cybersecurity, build/deploy. Infrastructure counterparts are listed on the public sub-processor page.

Public Trust — secure operational foundation · Sub-processors
Internal Critical-domain list in operating policy and access review

10. Secure equipment disposal

Are old devices and data removed securely and according to policy?

Partial Cloud deletion and retention exist (privacy / DPA paths). No written media-wipe / device-disposal procedure for the company laptop.

Public Privacy policy · Customer DPA
Internal KV TTL and R2 retention notes; no media-wipe SOP yet

3

Security

11. Is MFA active?

Is multi-factor authentication in use on relevant systems?

Yes Owner confirmed 5 September 2026: MFA on infrastructure, development tools, and email consoles (Clerk, Cloudflare/Google, Vercel, GitHub, Stripe, Upstash, Resend, OpenAI, Anthropic, Meta, Cookiebot). Does not claim Clerk forces MFA on every HEA customer account.

Public Trust — authentication (shared responsibility) · Clerk session / MFA docs
Internal access_review_record_20260706.md — owner MFA confirm 2026-09-05

12. Is endpoint security active?

Is endpoint protection (device security) active?

Partial One company MacBook Pro, self-managed: FileVault, lock screen, and updates required. Second MacBook and iPhone are personal. No MDM / EDR.

Public Trust — secure operational foundation
Internal device_security_baseline.md — 1 company MacBook Pro; no MDM/EDR

13. Are access rights controlled?

Are access rights managed and enforced?

Yes Clerk sessions, admin role checks, per-HEA isolation, fail-hard transfer/publish. Access control is a verified engineering control, not only a policy sentence.

Public Trust — private by design · Trust — authentication · Customer DPA
Internal Claims sec-access-control and sec-auth-sessions verified in code

14. Is there visibility into access rights?

Is there a current picture of who can access what?

Partial Dated access review (6 July 2026, MFA confirmed 5 September 2026) lists consoles and known holders. Review cadence is not yet a closed quarterly loop; collaborator-role evidence is still a gap.

Public Trust — authentication · Security contact
Internal access_review_record_20260706.md

15. Is network segmentation applied?

Is the network / environment segmented?

Partial Cloud equivalent: public vs admin vs widget CSP, secure / encrypted / public R2 tiers, preview vs production. Not a corporate LAN / VLAN programme.

Public Trust — data residency & storage tiers · Trust — private by design
Internal vercel.json / widget CSP contract; R2 secure vs public buckets

4

Incidents

16. Is there an incident response plan?

Does a written incident-response plan exist?

YesSolo founder Written vulnerability / incident intake plus a signed paper tabletop (5 September 2026). For a one-person company that is the IR plan. Residual: no NIS2 regulator notification template; deputy unassigned.

Public security.txt · Trust — incident response (Active) · Contact security
Internal security_vulnerability_intake_note.md; incident_tabletop_20260905.md

17. Do people know what to do in an incident?

Would the people involved know the first steps?

YesSolo founder The people involved are the founder. He wrote and signed the tabletop. There is no staff to train. Residual: deputy unassigned if the owner is offline (Q3).

Public security.txt · Contact security
Internal incident_tabletop_20260905.md — signed 2026-09-05

18. Are incidents tested?

Are incident scenarios exercised (tabletop or similar)?

YesSolo founder The question allows tabletop. Dated paper drill 5 September 2026 (leaked OpenAI key + Clerk takeover), signed by the founder. Not a timed live / red-team exercise.

Public Trust — incident response · security.txt
Internal incident_tabletop_20260905.md — paper walkthrough, signed 2026-09-05

19. Are backups tested?

Are backups restored or otherwise proven?

Partial Once-per-day KV snapshot to secure object storage plus written RTO/RPO and restore procedure. A restore test has not been executed (not a current priority).

Public Trust — backups, recovery, and rollback · Trust — data & infrastructure
Internal backup_restore_and_dr.md — restore_test row still pending

20. Is monitoring applied?

Is operational / security monitoring in place?

Yes Live public status page (15-minute probes of API, KV, R2, D1, Foundry plus Vercel, Cloudflare, OpenAI, Clerk, Stripe, Google Cloud). External NPEHolding watchdog. Cron calendar (backup, model qualification, billing health, smoketest). Hourly system-error digest emails on model-call / output failures. Cybersecurity and deploy-parity gates on every preview and production build. Residual: no third-party SIEM and not a 24/7 SOC — that is tooling, not “monitoring is absent.”

Public Live status page · Trust — secure operational foundation · Trust — incident detection
Internal Cron catalog + system error monitoring ring + vercelbuild deploy-parity baseline; claim sec-monitoring is verified

5

Suppliers & supply chain

21. Do you work with IT suppliers?

Does the organisation use IT suppliers / processors?

Yes Cloud-native. High-criticality path: Clerk, Vercel, Cloudflare, Stripe, OpenAI, Google Cloud, Upstash, Resend, Meta/WhatsApp, GitHub. Medium/low connectors also exist and are listed where they process personal data.

Public Sub-processors · Trust — infrastructure & model providers
Internal supplier_register.md — 31-row inventory; 10 high-criticality

22. Are suppliers assessed on security?

Are suppliers reviewed for security?

Partial Selection policy: high-criticality IT / Cloud / SaaS is limited to established Tier 1 industry providers, then owner DPA review (5 September 2026). That is vendor selection, not a questionnaire or collected SOC 2 / ISO pack. Medium/low vendors were not in that pass.

Public Sub-processors · Trust — vendor/subprocessor review · Clerk DPA · Vercel DPA · Cloudflare DPA · Stripe DPA · OpenAI DPA · Google Cloud DPA · Upstash DPA · Resend DPA · Meta DPA · GitHub DPA
Internal supplier_register.md selection policy; dpa_quick_reference.md

23. Are security requirements contractual?

Are security requirements written into contracts / DPAs?

Yes Customer DPA is published. Standard vendor DPAs for the ten high-criticality processors were owner-reviewed on 5 September 2026 (no objections). These are vendor paper, not custom HEA security schedules.

Public HEA World customer DPA · Terms · Clerk DPA · Vercel DPA · Cloudflare DPA · Stripe DPA · OpenAI DPA · Google Cloud DPA · Upstash DPA · Resend DPA · Meta DPA · GitHub DPA
Internal dpa_quick_reference.md — owner review 2026-09-05

24. Is there insight into supply-chain risks?

Are chain / subprocessor risks understood?

Partial Criticality, region, and owner-reviewed high-criticality DPAs exist. Public sub-processor page states EU vs SCC locations. A per-vendor transfer / SCC column is not yet filled in the internal register.

Public Sub-processors (locations / SCCs) · Customer DPA · Trust — data residency
Internal supplier_register.md — transfer column still open

25. Do suppliers have access to systems or data?

Can suppliers reach systems or personal / customer data?

NoInverted No supplier has standing access to HEA systems or personal / customer data. No MSP, no vendor login, no shared admin, no jump host. Consoles are owner-held only. Q21 remains Yes — Tier 1 SaaS run their own clouds under DPA. That is not supplier reach into HEA.

Public Trust — shared responsibility · Sub-processors · Customer DPA
Internal Access stance in supplier_register.md (2026-09-07); access_review_record_20260706.md

i

Company details

Public company and legal pages: hea-world.com · Trust · Privacy · DPA · Sub-processors · security.txt · Status · Contact.