Home
Resources
Strengthen Your Information Security with NIS2 Compliance Solution

DevOps

Strengthen Your Information Security with NIS2 Compliance Solution

Cloud Architecture Expert Co-founder & CTO of Gart

June 3, 2024

Strengthen Your Information Security with NIS2 Compliance Solution

The NIS2 (Network and Information Security Directive) is a comprehensive directive that mandates organizations to implement robust security measures and document compliance to protect critical assets and ensure community continuity.

For organizations subject to NIS2 requirements, CISOs, and IT security officers must ensure robust internal compliance preparedness.

Why NIS2 Compliance Matters

NIS2 aims to enhance the overall level of cybersecurity in the EU by:

Improving the resilience of critical infrastructure.
Enhancing the security of network and information systems.
Ensuring rapid response to and recovery from cyber incidents.

For organizations subject to NIS2 requirements, compliance is not just a legal obligation but a vital component of risk management and operational continuity. Failing to comply can result in significant financial penalties, reputational damage, and operational disruptions.

Who is affected by NIS2?

NIS2 affects all big organizations that work in the European Union and are considered important to society. This includes organizations that:

Have 50 or more employees, or
Make over €10 million in revenue each year

NIS2 puts these organizations into two groups:

Essential organizations – These are very important sectors like energy, healthcare, transportation, and water supply.
Important organizations – These are sectors like manufacturing, food production, waste management, and postal services.

So in simple terms, if your fairly large organization operates in the EU and provides crucial services or products to society, then NIS2 applies to you. The directive aims to ensure these vital entities have strong cybersecurity measures in place.

The penalties for not following NIS2 rules are different depending on whether an organization is labeled as “essential” or “important”.

For essential organizations:

They can be fined up to €10 million, or
They can be fined at least 2% of their total worldwide revenue from the previous year, whichever amount is higher.

For important organizations:

They can be fined up to €7 million, or
They can be fined at least 1.4% of their total worldwide revenue from the previous year, whichever amount is higher.

Gart’s NIS2 Solution

Gart offers a solution that simplifies the complexity of NIS2 compliance. The solution provides a systematic approach tailored to your ongoing operations and compliance efforts. By adopting Gart’s solution, you gain access to:

A systematic compliance framework for analyzing and documenting the security of critical assets.
Assurance of effective compliance work throughout your organization, aligned with good security practices and NIS2 requirements by applying ISO/EIC 27001/2 security principles.
Use of questionnaires to review the directive’s requirements and ensure all documentation requirements are met, preparing you for audits.
Clear guidance on how to register significant security incidents with CSIRT, ensuring a proactive approach.

How Does Gart Solution Support NIS2 Compliance?

NIS2 Requirement 1: Have policies for analyzing risks and information security

Gart can find and evaluate all assets, systems, weaknesses, and cyber/operational risks in critical infrastructure environments. It uses this detailed visibility to automatically create and enforce network security policies that reduce exposure to those identified risks.

In simple terms, Gart’s solution allows organizations to:

Discover all their critical assets, systems, and potential vulnerabilities
Assess the cyber and operational risks in their environments
Automatically define security policies to protect against those risks
Enforce those security policies across their networks

NIS2 Requirement 2: Dealing with Security Incidents

Gart Solutions constantly keeps watch over all critical infrastructure systems for any signs of potential threats, both known and new. It analyzes all security alerts in detail to prioritize the most important issues. Gart also integrates with existing security tools like SIEM and SOAR to extend an organization’s security processes across all of its critical systems.

In simpler terms, Gart’s solution allows organizations to:

Continuously monitor all their vital systems and networks
Quickly detect any potential cyber threats, even new unidentified ones
Understand the context and importance of every security alert
Work seamlessly with their existing security tools and workflows
Expand their incident response capabilities to cover all critical infrastructure

NIS2 Requirement 3: Managing Crises

Gart provides:

A complete, up-to-date list of all critical systems
Logging of all changes and unusual activity in assets and networks
Ability to create and enforce security policies to separate networks and control access
Ready integration with backup and recovery tools

All of these capabilities from Gart help organizations improve their overall crisis management and ensure the continuity of essential operations.

In simpler terms, Gart’s solution allows organizations to:

Know exactly what critical assets they have at all times
Track all activity so they can investigate incidents
Lock down systems by enforcing strict security controls
Quickly backup and restore systems if needed

NIS2 Requirement 4: Security of Networks and Information Systems

By utilizing Gart’s capabilities, customers can effectively:

Identify vulnerabilities and insecure configurations in their critical networks and systems
Assess and manage the cyber risks to their operational environments
Allow remote access for personnel to do their work securely

In simple terms, Gart helps organizations implement robust security measures for their networks and information systems as required by NIS2. This includes finding and fixing vulnerabilities, evaluating risks, and controlling access – all crucial for securing vital operational technology.

NIS2 Requirement 5: Basic Cybersecurity Practices and Training

Gart’s solution helps organizations:

Identify areas where they need to improve their basic cybersecurity habits and procedures based on risk assessments.

Ensure all personnel, whether employees or vendors, follow proper access controls, password management, and other essential cybersecurity practices.

Use the recommendations to develop training programs to raise cybersecurity awareness and skills.

NIS2 Requirement 6: Policies and Procedures for Data Encryption

Gart provides:

1) Encryption of all user data, critical system data, and other sensitive information in compliance with NIS2, GDPR, and other regulations.

2) Alerts when sensitive data like personal health records is being processed in a way that violates security policies or could lead to a data breach.

Here’s a rewording in simple language:

NIS2 Requirement 7: Using Multi-Factor Authentication and Secure Communications

Gart helps organizations:

– Enforce strong access controls like multi-factor authentication across their workforce and supply chain vendors/partners

– Allow only authorized and verified personnel to access critical systems remotely or on-site

– Ensure all communications to operational technology are fully secured

– Meet audit requirements by recording all access sessions

Key Features:

Mapping of Critical Assets

We will create an overview of the various types of critical assets within your value chain and document their security levels.

Risk Assessment of Critical Assets, Systems, and Processes

We will conduct a risk assessment based on the current threat landscape, the assets’ placement within the value chain, and their potential societal consequences.

GAP Analysis

We will obtain a clear overview of your current compliance level and implementation, identifying the essential control objectives required for NIS2.

Automated Processes

We will automate control follow-ups and communication with internal stakeholders to ensure all relevant tasks are carried out correctly and on time.

Compliance Control and Scope of SoA

We will begin with an initial compliance review, prioritize, and scope the Statement of Applicability (SoA) based on NIS2 requirements.

Create Awareness and Communicate Directly with Stakeholders

We will create awareness and directly communicate with stakeholders to keep everyone informed about policy and procedural changes, ensuring everyone understands their role.

Overview of Reporting to CSIRT

We will establish a process for reporting significant incidents and threats to the organization or its supply chain to CSIRT, protecting critical assets quickly and efficiently.

Ongoing Auditing

We will document internal compliance with NIS2 via dedicated management controls and functionality for auditing critical suppliers.

About NIS 2 Directive or NIS2 framework

The NIS 2 Directive, also referred to as the NIS2 framework, is a European Union regulation aimed at enhancing cybersecurity across the bloc. Here’s a breakdown of the key points:

Goals:

Improve overall cybersecurity posture in the EU.
Strengthen existing cybersecurity measures in critical sectors.
Ensure a consistent approach to cybersecurity risk management across member states.

Key Features:

Broader Scope: NIS2 applies to a wider range of sectors compared to the previous NIS Directive. This includes essential services (energy, transport, water, etc.) and important entities in sectors like waste management, postal services, manufacturing, and more.
Enhanced Risk Management: Organizations must implement robust cybersecurity measures to manage risks to their network and information systems. This includes measures to prevent incidents, minimize their impact, and report them effectively.
Incident Reporting: Entities are required to report significant incidents to relevant authorities. This allows for faster response and improved coordination across member states.
Supply Chain Security: The directive emphasizes the importance of supply chain security. Organizations need to consider the cybersecurity risks associated with their suppliers and vendors.
Cooperation and Information Sharing: Increased cooperation and information sharing among member states and relevant authorities are crucial aspects of NIS2.

Current Status:

Adopted in December 2022 and came into effect in January 2023.
EU member states have until October 17, 2024 to transpose the NIS2 Directive into national law.
By April 17, 2025, member states need to establish a list of essential entities falling under the directive.

Conclusion

The European Union’s Network and Information Security Directive, known as NIS2, sets stringent requirements for organizations to safeguard their critical assets and ensure the continuity of essential services.

Gart is here to guide you through every step of the process, providing the expertise, tools, and support you need to achieve and maintain compliance. With our systematic approach, you can focus on your core business operations, confident that your information security is in capable hands.

Are you ready to simplify your NIS2 compliance journey? Contact Gart today to learn more about how we can help you strengthen your information security and achieve regulatory compliance with ease.

Let’s work together!

See how we can help to overcome your challenges

FAQ

What is NIS2?

NIS2 is the revised Directive on Security of Network and Information Systems from the European Union. It sets cybersecurity requirements for entities operating critical infrastructure and important services in the EU.

Who does NIS2 apply to?

NIS2 applies to all medium and large entities operating in the EU that are considered essential or important to society and the economy. This includes sectors like energy, transport, healthcare, digital infrastructure, manufacturing, and others.

What are the key requirements of NIS2?

Some major NIS2 requirements include risk management policies, incident handling processes, supply chain security, encryption of data, secure communications, multi-factor authentication, cybersecurity training, and more.

What are the penalties for non-compliance?

Penalties for violating NIS2 can be severe financial fines up to €10 million or 2% of global revenue for essential entities, and up to €7 million or 1.4% of revenue for important entities.

How can Gart's solution help with NIS2 compliance?

Gart provides comprehensive capabilities to address multiple NIS2 requirements around risk assessment, incident response, supply chain security, encryption, secure access, and more for critical infrastructure environments.

IT Infrastructure

When Your IT Infrastructure Needs a Checkup: Signs It’s Time for an Audit

Fedir Kompaniiets

April 18, 2024

The business world feels like it's on fast forward these days. New tech pops up all the time, and keeping your data safe is getting trickier by the minute. No wonder businesses need to make sure their IT infrastructure is in tip-top shape! An IT infrastructure audit is basically a checkup for your tech systems, making sure they're ready for whatever comes next. Key Objectives of an IT Infrastructure Audit An IT infrastructure audit plays a crucial role in shaping an organization's technical and business development plans. The technical plan outlines the requirements, goals, architecture, and resources for IT infrastructure development. An audit helps identify the strengths and weaknesses of the current system, define requirements for future development and improvement of IT infrastructure, and plan the necessary resources and budget to accomplish these tasks. Core Objectives of an IT Infrastructure Audit: Security Evaluation An audit enables a comprehensive analysis of security levels, including the assessment of protective measures, data confidentiality, and prevention of potential threats. This is crucial for safeguarding information both within the organization and against external cyberattacks. Resource Optimization An audit helps uncover opportunities to optimize IT resources, enhance the performance and efficiency of IT systems, and streamline resource utilization within the organization Compliance Assessment An audit facilitates the evaluation of IT infrastructure's adherence to standards, regulatory documents, and legislation governing information systems. This helps confirm the organization's compliance with security, data privacy, and data integrity requirements. Development Planning The findings of an IT infrastructure audit serve as the foundation for developing an organization's technical and business development plans. The audit aids in identifying IT system strengths and weaknesses, prioritizing development needs, and planning system changes and upgrades based on concrete results and recommendations. Technical debt Technical debt is the accumulation of legacy systems, software, and hardware that can negatively impact the performance, security, and scalability of the IT infrastructure. An IT infrastructure audit can also be used to assess and manage technical debt. Loss and Disruption Prevention An audit helps identify potential risks and vulnerabilities in IT infrastructure, enabling proactive measures to mitigate them. Conducting an audit contributes to preventing potential disruptions and issues, and allows for the development of backup, data recovery, and business continuity plans. When an IT Infrastructure Audit is Essential Alright, let's talk about when you'd want to get that IT infrastructure audit done. These audits are crucial for organizations these days - they help make sure your tech is running smoothly and can handle whatever comes your way. Here are some key times when you'd definitely want to get an audit going: Implementing new systems and tech Bringing in new software, hardware, or information systems? Get an audit done first. It'll help you catch any potential issues or risks before you roll everything out, so you can make sure the new stuff integrates seamlessly and operates safely. Your business is growing or changing If your company is expanding, shifting gears, or just generally evolving, an audit can tell you if your IT infrastructure is ready to support those changes. It'll help you identify any problem areas, optimize your processes, and make sure your tech can keep up with the new business demands. Beefing up your security With all the cyberthreats out there these days, evaluating your system security is huge. An audit will show you where your vulnerabilities lie so you can shore up your defenses and protect your critical data and resources. Streamlining operations Audits don't just check for risks and problems - they can also uncover opportunities to optimize your processes and resources. Having that detailed look at how your tech is being used can help you cut costs, boost efficiency, and set the right performance metrics. So in a nutshell, IT infrastructure audits are essential for organizations dealing with growth, changes, security concerns, or just a need to run a tighter, more cost-effective tech operation. They give you the insights you need to keep your systems performing at their best. If you skip the audits, problems will just start piling up over time. Here's what can happen: Lack of info and unreliable data No IT audits means limited intel on the current state of your systems. You could end up using outdated or just plain wrong data when making important decisions. That makes planning a real headache and can lead to some seriously misguided strategic calls. Security risks and vulnerabilities Without regular audits, your organization is wide open to cyberattacks, data breaches, and other security issues. If you're not checking for weaknesses on the regular, you'll have no idea where you're vulnerable - and that's a disaster waiting to happen. Wasted resources No audits means you could be over or underutilizing your resources, which kills productivity and wastes money on ineffective solutions. That's a surefire way to lose your competitive edge. Doing those IT audits lets you get out in front of problems, optimize your resources, lock down your security, and make sure your tech is running like a well-oiled machine. It helps you make smart decisions, minimize risks, and keep up with your current needs. IT Infrastructure Audit Checklist Alright, on top of that stuff about the challenges of selecting an IT auditor, we've also put together an IT infrastructure audit checklist for you. This is like a handy reference guide to make sure you've covered all your bases when getting that audit done. The checklist hits on all the major areas an auditor is gonna want to dig into - things like your cloud infrastructure, virtual environment, data storage, and overall service architecture. We break down the key things that need to be evaluated in each of those domains. Cloud IT Infrastructure AuditDownload It's a comprehensive list, but easy to follow along with. Helps ensure the audit is thorough and you're not missing any critical components of your IT setup. Just go through it step-by-step and you'll have a clear roadmap for the auditor to follow. Key Considerations when Vetting IT Infrastructure Auditors Alright, let's talk about the common issues and challenges that organizations face when selecting an IT infrastructure auditor: Auditor Qualifications. One of the main problems is determining the true qualifications and professionalism of the auditor. Customers often have a hard time evaluating the auditor's actual experience. Accuracy and Objectivity. Ensuring the auditor will provide an unbiased, objective assessment is crucial. Customers want to be confident the auditor will thoroughly evaluate all aspects of the IT infrastructure without any preconceptions or subjectivity. Finding a reliable, responsible auditor who can guarantee the accuracy and objectivity of their work is a tricky task. Service Costs. The cost of the auditor's services is another significant challenge. Customers need to strike the right balance between service quality and price. Comprehensive IT infrastructure audits can be quite expensive, putting them out of reach for some organizations. However, the lowest price isn't always the best criteria, as rock-bottom costs may signal low-quality work. Availability and Timelines. Auditor availability and their ability to complete the work on schedule is another problem. Auditors are often booked on other projects or have time constraints, making it hard to find one who can fit the customer's schedule. Flexibility on timelines is important. Trust Issues. Trusting the auditor is a core challenge. Customers need to be confident in the auditor's reliability and their ability to provide an accurate assessment. Checking references, reviews, and credentials can help address this. Selecting an IT infrastructure auditor is a complex, high-stakes process. Thoroughly researching the auditor's background, experience, and reputation online can provide valuable insights. For example, at Gart Solutions, we publish client reviews and share details on our completed audit engagements. How Often Should You Conduct IT Infrastructure Audits? As a general rule, companies should conduct an IT infrastructure audit at least once a year. However, in some cases, more frequent audits might be necessary. For instance, companies handling sensitive data may require audits every six months or even quarterly. The results of an IT infrastructure audit should lead to a series of action items, such as: Addressing security vulnerabilities: The audit should identify any security weaknesses within the IT infrastructure, and steps should be taken to close those gaps. Enhancing performance: The audit should pinpoint areas where IT infrastructure performance can be improved, and actions should be taken to implement those improvements. Reducing costs: The audit should identify areas where IT infrastructure costs can be lowered, and actions should be taken to achieve those cost savings. Developing a Business Continuity Plan (BCP): A BCP outlines how the company will continue operations in case of an IT outage. The audit should contribute to developing or updating an existing BCP. A well-conducted IT infrastructure audit can significantly help businesses maintain a secure, performant, and cost-effective IT infrastructure. The final report's got the full scoop on any issues or weaknesses they found in the infrastructure. This gives the leadership team a clear, unbiased view of where things are at and what needs to be fixed. Armed with those audit results, they can put together an action plan to boost the efficiency of the tech, optimize the processes, and shore up any vulnerabilities in the system. The key is using that audit as a roadmap to getting the IT infrastructure operating at peak performance. No more guesswork - just cold, hard data to drive the improvements. Gart Solutions - Your Trusted DevOps & Cloud Services Provider. We have extensive experience conducting IT infrastructure audits that deliver the insights organizations need. Our case studies: Infrastructure Optimization and Data Management in Healthcare AWS Infrastructure Optimization and CI/CD Transformation for a Crypto Exchange New Infrastructure Design and GCP Cost Optimization for Telecom SaaS Application AWS Migration & Infrastructure Localization for Sportsbook Platform

IT Infrastructure

How to Calculate Cloud Migration Costs and Avoid Overpaying for Services After Migration

Roman Burdiuzha

April 8, 2024

Speaking of the benefits of cloud deployment, simplicity of use, flexibility, scalability, and reliability are often mentioned. However, migration is not just about moving infrastructure to the cloud, it is also about switching to a different cost model. To understand how profitable this is, it is necessary to calculate the current costs of local infrastructure, the planned costs of the cloud, as well as the cost of migration. In this article, we will tell you how to correctly calculate the costs of transferring infrastructure and not overpay for services after migration. Key Questions to Consider Before Cloud Migration Here are some questions businesses should ask themselves before migrating to the cloud: Is downtime critical for the company? There is no need for the cloud if the business can wait a day or two for server and other component recovery/replacement without major consequences. Has the equipment been purchased? How long ago? Cloud migration can be delayed if the servers are less than three years old and the company does not plan to grow rapidly. Is a cloud solution necessary? A cloud solution is necessary if the project is new and the equipment is not yet available. Or if it is already working, the infrastructure is more than three years old, and one to four hours of downtime is critical for the company. Other questions to consider: What are the business goals for migrating to the cloud? What are the specific applications and workloads that will be migrated? What are the security and compliance requirements for the cloud environment? What are the costs and benefits of migrating to the cloud? What is the migration timeline and plan? Who will be responsible for managing the cloud environment after migration? Local Infrastructure Costs To determine the potential financial benefits of migrating to the cloud, it is necessary to calculate the current costs of the local infrastructure as accurately as possible and obtain data on its performance. Only then will it be possible to determine the correct configuration of the cloud infrastructure and compare the current local costs with the planned costs in the cloud. Costs are divided into direct and indirect. Direct costs: Capital expenditures: Purchase of servers, storage systems, network equipment, etc. Software licenses. Data center construction or rental costs. Operational expenditures: Electricity costs. Cooling costs. Maintenance and repair costs. IT staff salaries. To calculate the total cost of local infrastructure, it is necessary to consider all of these factors. Once the total cost is known, it can be compared to the cost of cloud computing to determine whether migration is financially viable. Direct Costs Direct costs can be broken down into five main categories: IT Equipment Acquisition: This includes the purchase of servers, storage systems, network equipment, and other IT hardware. Data Center Colocation or Server Room Maintenance: This includes the cost of renting space in a data center or maintaining your own server room. Software Licensing and Renewals: This includes the cost of purchasing and renewing licenses for operating systems, applications, and other software. Hardware Setup and Maintenance: This includes the cost of installing, configuring, and maintaining IT hardware. Software Updates and Equipment Service Contracts: This includes the cost of purchasing software updates and service contracts for IT hardware. IT Personnel: This includes the cost of salaries, taxes, health insurance, vacation, bonuses, and office equipment for IT staff. It is also important to consider the costs of HR, procurement, and accounting departments. These departments also spend some of their resources on ensuring the functionality of the corporate IT infrastructure Indirect Costs Indirect costs are not as obvious as direct costs and can be more difficult to calculate. The main part of indirect costs is related to downtime, customer dissatisfaction, damage to business reputation, and lost profits. An example of indirect costs would be a corporate website crashing or freezing on Black Friday. One way to calculate indirect costs is to review incident and degradation reports to determine how often and for how long the equipment fails. To calculate the amount of damage, it is necessary to multiply the downtime by the average hourly rate of employees. Indirect costs: Downtime costs: Lost productivity due to system outages. Revenue losses due to unavailability of applications or services. Security risks: Data breaches. Compliance violations. Business agility: Inability to quickly scale up or down resources to meet changing business needs. Cloud Migration Costs Several key factors influence the cost of cloud migration. These include: Defining migration goals: It is important to clearly define the goals of the migration before starting the process. This will help to determine the scope of the migration and the resources required. Identifying key pain points: Once the goals are defined, it is important to identify the key pain points that the migration is intended to address. This will help to prioritize the migration tasks and focus on the areas that will have the biggest impact. Data volume to be transferred: The amount of data that needs to be migrated will have a significant impact on the cost of the migration. It is important to accurately estimate the amount of data to be transferred and to choose a migration method that is appropriate for the volume of data. Cloud service model: The cost of cloud migration will also vary depending on the cloud service model chosen. Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) all have different pricing models. Provider selection: The cost of cloud migration will also vary depending on the cloud provider chosen. It is important to compare the pricing and features of different cloud providers before making a decision. It is also necessary to assess the readiness of local applications for cloud operation. This is necessary to understand what can be immediately transferred to the cloud, what needs to be modernized, and what is better left in the local environment. Costs will need to be calculated for each scenario. The migration process itself is the most labor-intensive and costly part of the migration. The costs of this stage consist of the following: Initial costs for deploying new servers and cloud services. At the same time, the organization will incur additional time and financial costs for local infrastructure and data synchronization. Modification of applications and code, creation of new infrastructure according to business needs. A significant part of the costs is for labor. Solving potential problems with data privacy and security during the move. Overall, it is quite difficult to calculate the exact cost of migration. The cost of migration depends heavily on the skills of the team. The more qualified it is, the lower the cost of the move. A cloud provider or partner with the necessary competencies can help reduce the time and cost of migration. Successful Cloud Migration Case Studies by Gart: Consulting Case: Migration from On-Premise to AWS for a Financial Company Implementation of Nomad Cluster for Massively Parallel Computing – AWS Performance Optimization DevOps in Gambling: Digital Transformation for Betting Provider Gart’s Expertise in ISO 27001 Compliance Empowers Spiral Technology for Seamless Audits and Cloud Migration Future Cloud Infrastructure Costs After the migration, the cost structure changes. There is a regular fee for computing resources. However, it is only possible to estimate the costs of cloud infrastructure approximately, since it is difficult to predict the exact amount of resources needed to host applications in the cloud. Fortunately for the customer, the estimate is usually higher than the actual costs. This is because the estimate is based on their own equipment, which is purchased with a margin. In the end, VM resources are optimized, and scaling is done on an as-needed basis. How to Avoid Unnecessary Expenses Ironically, many organizations move to the cloud to reduce costs, but in reality they overpay. According to a 2023 report by the American company Flexera, respondents estimated that their organizations lost 32% due to overspending. Therefore, before migrating, it is necessary to develop a strategy for working and optimizing in the cloud. Depending on the industry, strategies may vary, so it is important to start from the needs of the business and the real VM load. Here are some tips for avoiding unnecessary cloud infrastructure costs: Optimize Costs It is important to track your monthly cloud spending to identify any areas where you may be overspending. If you are not using a cloud service, you should terminate it to avoid paying for it. You should rightsize your VMs to ensure that you are only paying for the resources that you need. You can use spot instances to save money on your cloud costs. Control Resource Allocation To avoid overspending, it is important to use the correct amount of cloud resources. Most often, part of the cloud storage volume is wasted because it is larger than necessary. According to Flexera, 40% of cloud instances exceed the workloads required for operation. Here are some tips for controlling resource allocation: When you create a VM, you should choose the right size for your needs. There are many different VM sizes available, so you should be able to find one that is a good fit for your requirements. You can use resource groups and tags to organize your cloud resources. This will make it easier to track your usage and costs. You can use autoscaling to scale your cloud resources up or down as needed. This will help you to avoid overprovisioning resources. You should monitor your cloud usage to track your resource allocation. You can use a cloud monitoring tool to help you monitor your usage. Read more: 20 Easy Ways to Optimize Expenses on AWS and Save Over 80% of Your Budget Comparing cloud provider services Comparing cloud provider services is a complex task, but it helps to reduce the overexpenditure of cloud resources. Organizations that work with multiple providers at the same time must regularly review their contracts, which helps to reduce their cost. Revaluating assets Conduct an assessment to identify and remove assets that have become unnecessary. It is also worth using cloud cost optimization tools. Choosing a migration model You can choose one of the three main models, namely migration to: Public cloud You purchase the capacities of one or more large data centers that simultaneously cooperate with many clients. This is an option that provides the business with the necessary flexibility and the ability to automate routine tasks. Private cloud Development and arrangement of your own cloud infrastructure on your own resources. This is a great solution for large companies with a developed IT infrastructure, a large number of branches, and those who find it difficult to maintain the operability of the system under the old conditions. A private cloud allows you to ensure absolute confidentiality of important data. Hybrid cloud A compromise option, when the main array of services and data is serviced on its own resources, and due to an external data center, the company has the opportunity to quickly and confidently scale, as well as test new technological solutions without the risk of "letting in" the main system. Whichever option you choose, Gart Solutions will help you understand how to design and create a cloud for file storage and hosting your infrastructure, so that your business processes are as protected as possible from the influence of any factors, and are also efficient regardless of the scale of your activities. Regardless of the method you choose for migration to the cloud, we will help implement all the possibilities of this choice in practice, including automatic backup to the cloud.↳ Conclusion Migration to the cloud and the transition to a new cost model can be beneficial for business if you approach this process responsibly: compare the costs of local infrastructure and cloud in advance, develop a strategy and carefully monitor costs. Gart Solutions will be happy to take over the "turnkey" migration to the cloud, freeing up the time of your company's specialists for the implementation of more important projects.

0 Easy Ways to Optimize AWS Costs and Save Over 80% of Your Budget

Cloud

20 Easy Ways to Optimize Expenses on AWS and Save Over 80% of Your Budget

Fedir Kompaniiets

December 13, 2023

In my experience optimizing cloud costs, especially on AWS, I often find that many quick wins are in the "easy to implement - good savings potential" quadrant. [lwptoc] That's why I've decided to share some straightforward methods for optimizing expenses on AWS that will help you save over 80% of your budget. Choose reserved instances Potential Savings: Up to 72% Choosing reserved instances involves committing to a subscription, even partially, and offers a discount for long-term rentals of one to three years. While planning for a year is often deemed long-term for many companies, especially in Ukraine, reserving resources for 1-3 years carries risks but comes with the reward of a maximum discount of up to 72%. You can check all the current pricing details on the official website - Amazon EC2 Reserved Instances Purchase Saving Plans (Instead of On-Demand) Potential Savings: Up to 72% There are three types of saving plans: Compute Savings Plan, EC2 Instance Savings Plan, SageMaker Savings Plan. AWS Compute Savings Plan is an Amazon Web Services option that allows users to receive discounts on computational resources in exchange for committing to using a specific volume of resources over a defined period (usually one or three years). This plan offers flexibility in utilizing various computing services, such as EC2, Fargate, and Lambda, at reduced prices. AWS EC2 Instance Savings Plan is a program from Amazon Web Services that offers discounted rates exclusively for the use of EC2 instances. This plan is specifically tailored for the utilization of EC2 instances, providing discounts for a specific instance family, regardless of the region. AWS SageMaker Savings Plan allows users to get discounts on SageMaker usage in exchange for committing to using a specific volume of computational resources over a defined period (usually one or three years). The discount is available for one and three years with the option of full, partial upfront payment, or no upfront payment. EC2 can help save up to 72%, but it applies exclusively to EC2 instances. Utilize Various Storage Classes for S3 (Including Intelligent Tier) Potential Savings: 40% to 95% AWS offers numerous options for storing data at different access levels. For instance, S3 Intelligent-Tiering automatically stores objects at three access levels: one tier optimized for frequent access, 40% cheaper tier optimized for infrequent access, and 68% cheaper tier optimized for rarely accessed data (e.g., archives). S3 Intelligent-Tiering has the same price per 1 GB as S3 Standard — $0.023 USD. However, the key advantage of Intelligent Tiering is its ability to automatically move objects that haven't been accessed for a specific period to lower access tiers. Every 30, 90, and 180 days, Intelligent Tiering automatically shifts an object to the next access tier, potentially saving companies from 40% to 95%. This means that for certain objects (e.g., archives), it may be appropriate to pay only $0.0125 USD per 1 GB or $0.004 per 1 GB compared to the standard price of $0.023 USD. Information regarding the pricing of Amazon S3 AWS Compute Optimizer Potential Savings: quite significant The AWS Compute Optimizer dashboard is a tool that lets users assess and prioritize optimization opportunities for their AWS resources. The dashboard provides detailed information about potential cost savings and performance improvements, as the recommendations are based on an analysis of resource specifications and usage metrics. The dashboard covers various types of resources, such as EC2 instances, Auto Scaling groups, Lambda functions, Amazon ECS services on Fargate, and Amazon EBS volumes. For example, AWS Compute Optimizer reproduces information about underutilized or overutilized resources allocated for ECS Fargate services or Lambda functions. Regularly keeping an eye on this dashboard can help you make informed decisions to optimize costs and enhance performance. Use Fargate in EKS for underutilized EC2 nodes If your EKS nodes aren't fully used most of the time, it makes sense to consider using Fargate profiles. With AWS Fargate, you pay for a specific amount of memory/CPU resources needed for your POD, rather than paying for an entire EC2 virtual machine. For example, let's say you have an application deployed in a Kubernetes cluster managed by Amazon EKS (Elastic Kubernetes Service). The application experiences variable traffic, with peak loads during specific hours of the day or week (like a marketplace or an online store), and you want to optimize infrastructure costs. To address this, you need to create a Fargate Profile that defines which PODs should run on Fargate. Configure Kubernetes Horizontal Pod Autoscaler (HPA) to automatically scale the number of POD replicas based on their resource usage (such as CPU or memory usage). Manage Workload Across Different Regions Potential Savings: significant in most cases When handling workload across multiple regions, it's crucial to consider various aspects such as cost allocation tags, budgets, notifications, and data remediation. Cost Allocation Tags: Classify and track expenses based on different labels like program, environment, team, or project. AWS Budgets: Define spending thresholds and receive notifications when expenses exceed set limits. Create budgets specifically for your workload or allocate budgets to specific services or cost allocation tags. Notifications: Set up alerts when expenses approach or surpass predefined thresholds. Timely notifications help take actions to optimize costs and prevent overspending. Remediation: Implement mechanisms to rectify expenses based on your workload requirements. This may involve automated actions or manual interventions to address cost-related issues. Regional Variances: Consider regional differences in pricing and data transfer costs when designing workload architectures. Reserved Instances and Savings Plans: Utilize reserved instances or savings plans to achieve cost savings. AWS Cost Explorer: Use this tool for visualizing and analyzing your expenses. Cost Explorer provides insights into your usage and spending trends, enabling you to identify areas of high costs and potential opportunities for cost savings. Transition to Graviton (ARM) Potential Savings: Up to 30% Graviton utilizes Amazon's server-grade ARM processors developed in-house. The new processors and instances prove beneficial for various applications, including high-performance computing, batch processing, electronic design automation (EDA) automation, multimedia encoding, scientific modeling, distributed analytics, and machine learning inference on processor-based systems. The processor family is based on ARM architecture, likely functioning as a system on a chip (SoC). This translates to lower power consumption costs while still offering satisfactory performance for the majority of clients. Key advantages of AWS Graviton include cost reduction, low latency, improved scalability, enhanced availability, and security. Spot Instances Instead of On-Demand Potential Savings: Up to 30% Utilizing spot instances is essentially a resource exchange. When Amazon has surplus resources lying idle, you can set the maximum price you're willing to pay for them. The catch is that if there are no available resources, your requested capacity won't be granted. However, there's a risk that if demand suddenly surges and the spot price exceeds your set maximum price, your spot instance will be terminated. Spot instances operate like an auction, so the price is not fixed. We specify the maximum we're willing to pay, and AWS determines who gets the computational power. If we are willing to pay $0.1 per hour and the market price is $0.05, we will pay exactly $0.05. Use Interface Endpoints or Gateway Endpoints to save on traffic costs (S3, SQS, DynamoDB, etc.) Potential Savings: Depends on the workload Interface Endpoints operate based on AWS PrivateLink, allowing access to AWS services through a private network connection without going through the internet. By using Interface Endpoints, you can save on data transfer costs associated with traffic. Utilizing Interface Endpoints or Gateway Endpoints can indeed help save on traffic costs when accessing services like Amazon S3, Amazon SQS, and Amazon DynamoDB from your Amazon Virtual Private Cloud (VPC). Key points: Amazon S3: With an Interface Endpoint for S3, you can privately access S3 buckets without incurring data transfer costs between your VPC and S3. Amazon SQS: Interface Endpoints for SQS enable secure interaction with SQS queues within your VPC, avoiding data transfer costs for communication with SQS. Amazon DynamoDB: Using an Interface Endpoint for DynamoDB, you can access DynamoDB tables in your VPC without incurring data transfer costs. Additionally, Interface Endpoints allow private access to AWS services using private IP addresses within your VPC, eliminating the need for internet gateway traffic. This helps eliminate data transfer costs for accessing services like S3, SQS, and DynamoDB from your VPC. Optimize Image Sizes for Faster Loading Potential Savings: Depends on the workload Optimizing image sizes can help you save in various ways. Reduce ECR Costs: By storing smaller instances, you can cut down expenses on Amazon Elastic Container Registry (ECR). Minimize EBS Volumes on EKS Nodes: Keeping smaller volumes on Amazon Elastic Kubernetes Service (EKS) nodes helps in cost reduction. Accelerate Container Launch Times: Faster container launch times ultimately lead to quicker task execution. Optimization Methods: Use the Right Image: Employ the most efficient image for your task; for instance, Alpine may be sufficient in certain scenarios. Remove Unnecessary Data: Trim excess data and packages from the image. Multi-Stage Image Builds: Utilize multi-stage image builds by employing multiple FROM instructions. Use .dockerignore: Prevent the addition of unnecessary files by employing a .dockerignore file. Reduce Instruction Count: Minimize the number of instructions, as each instruction adds extra weight to the hash. Group instructions using the && operator. Layer Consolidation: Move frequently changing layers to the end of the Dockerfile. These optimization methods can contribute to faster image loading, reduced storage costs, and improved overall performance in containerized environments. Use Load Balancers to Save on IP Address Costs Potential Savings: depends on the workload Starting from February 2024, Amazon begins billing for each public IPv4 address. Employing a load balancer can help save on IP address costs by using a shared IP address, multiplexing traffic between ports, load balancing algorithms, and handling SSL/TLS. By consolidating multiple services and instances under a single IP address, you can achieve cost savings while effectively managing incoming traffic. Optimize Database Services for Higher Performance (MySQL, PostgreSQL, etc.) Potential Savings: depends on the workload AWS provides default settings for databases that are suitable for average workloads. If a significant portion of your monthly bill is related to AWS RDS, it's worth paying attention to parameter settings related to databases. Some of the most effective settings may include: Use Database-Optimized Instances: For example, instances in the R5 or X1 class are optimized for working with databases. Choose Storage Type: General Purpose SSD (gp2) is typically cheaper than Provisioned IOPS SSD (io1/io2). AWS RDS Auto Scaling: Automatically increase or decrease storage size based on demand. If you can optimize the database workload, it may allow you to use smaller instance sizes without compromising performance. Regularly Update Instances for Better Performance and Lower Costs Potential Savings: Minor As Amazon deploys new servers in their data processing centers to provide resources for running more instances for customers, these new servers come with the latest equipment, typically better than previous generations. Usually, the latest two to three generations are available. Make sure you update regularly to effectively utilize these resources. Take Memory Optimize instances, for example, and compare the price change based on the relevance of one instance over another. Regular updates can ensure that you are using resources efficiently. InstanceGenerationDescriptionOn-Demand Price (USD/hour)m6g.large6thInstances based on ARM processors offer improved performance and energy efficiency.$0.077m5.large5thGeneral-purpose instances with a balanced combination of CPU and memory, designed to support high-speed network access.$0.096m4.large4thA good balance between CPU, memory, and network resources.$0.1m3.large3rdOne of the previous generations, less efficient than m5 and m4.Not avilable Use RDS Proxy to reduce the load on RDS Potential for savings: Low RDS Proxy is used to relieve the load on servers and RDS databases by reusing existing connections instead of creating new ones. Additionally, RDS Proxy improves failover during the switch of a standby read replica node to the master. Imagine you have a web application that uses Amazon RDS to manage the database. This application experiences variable traffic intensity, and during peak periods, such as advertising campaigns or special events, it undergoes high database load due to a large number of simultaneous requests. During peak loads, the RDS database may encounter performance and availability issues due to the high number of concurrent connections and queries. This can lead to delays in responses or even service unavailability. RDS Proxy manages connection pools to the database, significantly reducing the number of direct connections to the database itself. By efficiently managing connections, RDS Proxy provides higher availability and stability, especially during peak periods. Using RDS Proxy reduces the load on RDS, and consequently, the costs are reduced too. Define the storage policy in CloudWatch Potential for savings: depends on the workload, could be significant. The storage policy in Amazon CloudWatch determines how long data should be retained in CloudWatch Logs before it is automatically deleted. Setting the right storage policy is crucial for efficient data management and cost optimization. While the "Never" option is available, it is generally not recommended for most use cases due to potential costs and data management issues. Typically, best practice involves defining a specific retention period based on your organization's requirements, compliance policies, and needs. Avoid using an undefined data retention period unless there is a specific reason. By doing this, you are already saving on costs. Configure AWS Config to monitor only the events you need Potential for savings: depends on the workload AWS Config allows you to track and record changes to AWS resources, helping you maintain compliance, security, and governance. AWS Config provides compliance reports based on rules you define. You can access these reports on the AWS Config dashboard to see the status of tracked resources. You can set up Amazon SNS notifications to receive alerts when AWS Config detects non-compliance with your defined rules. This can help you take immediate action to address the issue. By configuring AWS Config with specific rules and resources you need to monitor, you can efficiently manage your AWS environment, maintain compliance requirements, and avoid paying for rules you don't need. Use lifecycle policies for S3 and ECR Potential for savings: depends on the workload S3 allows you to configure automatic deletion of individual objects or groups of objects based on specified conditions and schedules. You can set up lifecycle policies for objects in each specific bucket. By creating data migration policies using S3 Lifecycle, you can define the lifecycle of your object and reduce storage costs. These object migration policies can be identified by storage periods. You can specify a policy for the entire S3 bucket or for specific prefixes. The cost of data migration during the lifecycle is determined by the cost of transfers. By configuring a lifecycle policy for ECR, you can avoid unnecessary expenses on storing Docker images that you no longer need. Switch to using GP3 storage type for EBS Potential for savings: 20% By default, AWS creates gp2 EBS volumes, but it's almost always preferable to choose gp3 — the latest generation of EBS volumes, which provides more IOPS by default and is cheaper. For example, in the US-east-1 region, the price for a gp2 volume is $0.10 per gigabyte-month of provisioned storage, while for gp3, it's $0.08/GB per month. If you have 5 TB of EBS volume on your account, you can save $100 per month by simply switching from gp2 to gp3. Switch the format of public IP addresses from IPv4 to IPv6 Potential for savings: depending on the workload Starting from February 1, 2024, AWS will begin charging for each public IPv4 address at a rate of $0.005 per IP address per hour. For example, taking 100 public IP addresses on EC2 x $0.005 per public IP address per month x 730 hours = $365.00 per month. While this figure might not seem huge (without tying it to the company's capabilities), it can add up to significant network costs. Thus, the optimal time to transition to IPv6 was a couple of years ago or now. Here are some resources about this recent update that will guide you on how to use IPv6 with widely-used services — AWS Public IPv4 Address Charge. Collaborate with AWS professionals and partners for expertise and discounts Potential for savings: ~5% of the contract amount through discounts. AWS Partner Network (APN) Discounts: Companies that are members of the AWS Partner Network (APN) can access special discounts, which they can pass on to their clients. Partners reaching a certain level in the APN program often have access to better pricing offers. Custom Pricing Agreements: Some AWS partners may have the opportunity to negotiate special pricing agreements with AWS, enabling them to offer unique discounts to their clients. This can be particularly relevant for companies involved in consulting or system integration. Reseller Discounts: As resellers of AWS services, partners can purchase services at wholesale prices and sell them to clients with a markup, still offering a discount from standard AWS prices. They may also provide bundled offerings that include AWS services and their own additional services. Credit Programs: AWS frequently offers credit programs or vouchers that partners can pass on to their clients. These could be promo codes or discounts for a specific period. Seek assistance from AWS professionals and partners. Often, this is more cost-effective than purchasing and configuring everything independently. Given the intricacies of cloud space optimization, expertise in this matter can save you tens or hundreds of thousands of dollars. More valuable tips for optimizing costs and improving efficiency in AWS environments: Scheduled TurnOff/TurnOn for NonProd environments: If the Development team is in the same timezone, significant savings can be achieved by, for example, scaling the AutoScaling group of instances/clusters/RDS to zero during the night and weekends when services are not actively used. Move static content to an S3 Bucket & CloudFront: To prevent service charges for static content, consider utilizing Amazon S3 for storing static files and CloudFront for content delivery. Use API Gateway/Lambda/Lambda Edge where possible: In such setups, you only pay for the actual usage of the service. This is especially noticeable in NonProd environments where resources are often underutilized. If your CI/CD agents are on EC2, migrate to CodeBuild: AWS CodeBuild can be a more cost-effective and scalable solution for your continuous integration and delivery needs. CloudWatch covers the needs of 99% of projects for Monitoring and Logging: Avoid using third-party solutions if AWS CloudWatch meets your requirements. It provides comprehensive monitoring and logging capabilities for most projects. Feel free to reach out to me or other specialists for an audit, a comprehensive optimization package, or just advice.

Why NIS2 Compliance Matters

Who is affected by NIS2?

Gart’s NIS2 Solution

How Does Gart Solution Support NIS2 Compliance?

NIS2 Requirement 1: Have policies for analyzing risks and information security

NIS2 Requirement 2: Dealing with Security Incidents

NIS2 Requirement 3: Managing Crises

NIS2 Requirement 4: Security of Networks and Information Systems

NIS2 Requirement 5: Basic Cybersecurity Practices and Training

NIS2 Requirement 6: Policies and Procedures for Data Encryption

NIS2 Requirement 7: Using Multi-Factor Authentication and Secure Communications

Key Features:

About NIS 2 Directive or NIS2 framework

Conclusion

FAQ

What is NIS2?

Who does NIS2 apply to?

What are the key requirements of NIS2?

What are the penalties for non-compliance?

How can Gart's solution help with NIS2 compliance?

You might also like

When Your IT Infrastructure Needs a Checkup: Signs It’s Time for an Audit

How to Calculate Cloud Migration Costs and Avoid Overpaying for Services After Migration

20 Easy Ways to Optimize Expenses on AWS and Save Over 80% of Your Budget

Subscribe to our blog