Workshop
In a half-day session with your board and IT team, we discuss which systems and data require additional protection or control. We define the scope of the assessment.
Devices, cloud and support, run as one service.
Managed cybersecurity in five service levels.
NIS2, DORA, GDPR and the Cyber Resilience Act in one assessment.
Check where your organisation stands.
One named CISO, two days a month.
Monitoring and incident response from our European SOC.
Test your systems and your response to phishing.
With your board and IT team we map your service chain and the dependencies you want to reduce. Scope and a fixed price are agreed in advance.
Discuss a workshopOur organisation and how we work.
Amsterdam and our EU delivery centres.
The platforms we implement and operate.
Services for cloud providers and IT partners.
What the work looks like, and references on request.
The client team in Amsterdam, the engineering in our EU delivery centres, everything inside the EU. One contract, under Dutch law.
How we deliver




Sovereign managed services
Think Smart Europe manages your IT and runs your security from within the European Union, with a named point of contact in the Netherlands. Together we map who has access to your systems and data, and which dependencies you want to reduce.
Managed IT and SmartCyber
Your people need to get on with their work. Your systems need maintenance and protection. Both services come from the same European team, under one contract. We take over the agreed work and put the split of tasks between us and your own team in writing.
We look after your devices, network and cloud environment. Users can turn to the service desk for help. We manage Microsoft 365 and your servers, handle updates, access rights and changes, and test that backups can be restored. Your own IT team has room to focus on developing your organisation.
Availability and support outside business hours are specified in the agreement.
SmartCyber puts your security measures in place and keeps them up to date. Depending on the level, the service covers protection for devices, email and accounts, monitoring of suspicious activity, vulnerability management and reporting for your board. Where monitoring is included, our analysts investigate alerts and respond to incidents as agreed with your organisation. There are five levels, matched to your size and your obligations.
From Advanced upwards, the service includes a 24/7 SOC inside the EU, with a 15-minute response time for priority alerts under the SLA.
European delivery
Think Smart Europe B.V. is a Dutch company under Dutch law, headquartered in Amsterdam, the Netherlands, and your contracting party. Every shareholder is an EU holding company. There is no non-EU parent and no non-EU capital.
Your client team in Amsterdam holds the meetings with your organisation. Our teams in our EU delivery centres handle the technical management and security work. We document who performs each activity and how escalations are handled.
Technical delivery operates under the management systems of our EU delivery organisation, certified to ISO 27001, ISO 27701, ISO 9001, ISO 20000-1 and ISO 37001.
Digital sovereignty
Digital sovereignty covers the whole service chain: who owns your suppliers, which software is in use, who has administrator access and where your security data is processed. The proposed Cloud and AI Development Act, CADA, would make sovereignty a buying rule. Public bodies would have to buy cloud services at a minimum assurance level, and organisations in the sectors NIS2 lists as highly critical may be asked to run the same assessment. The European Commission's Cloud Sovereignty Framework makes that measurable. We map your dependencies with you using the same framework, so you see where your current environment meets your requirements and which changes are needed.
Workshop and assessment
Your board and IT team need the same starting point before anything changes. We begin with your current environment and the requirements it has to meet.
In a half-day session with your board and IT team, we discuss which systems and data require additional protection or control. We define the scope of the assessment.
We examine your services and supplier chain against the Cloud Sovereignty Framework. The same assessment covers the supplier risks NIS2 asks you to manage. You receive an assessment of your dependencies and an overview of the areas that need attention.
We prepare a workable plan with priorities, costs and responsibilities. Your board can use it to decide which changes to make.
After the agreed changes, we manage the environment and report on the work. At set intervals we check whether the service still meets your requirements.
We agree the scope and a fixed price for the workshop and assessment in advance. Discuss a workshop.
Regulation and accountability
A board member, customer or auditor needs to see which measures are in place and how they are run. Our service reports on the agreed management and security work.
NIS2 sets registration, security and reporting duties for organisations in eighteen sectors, through national law such as the Dutch Cyberbeveiligingswet. Our services cover the ten NIS2 measures, and during an incident our SOC helps you draft the 24-hour and 72-hour notifications.
The Cyber Resilience Act applies to hardware and software placed on the EU market and binds manufacturers, importers and distributors. Reporting duties have applied since 11 September 2026. The main obligations apply from 11 December 2027.
The Cloud and AI Development Act, CADA, is a Commission proposal from June 2026 that is still under discussion in the European Parliament and the Council. It would introduce European assurance levels for the sovereignty of cloud and AI services, starting with what public bodies buy. The workshop and assessment above cover the questions it raises for your service chain.
Through compliance advisory, we map which obligations are likely to apply to your organisation and what support fits.
Working with partners
We offer cloud providers and IT partners additional capacity for IT management, security operations and sovereignty assessments. We complement your team and do not compete with it. We can refer clients to one another, deliver services under your name or work together on a joint offering. The same SOC and the same engineers do the work in every model.
Arrangements for client contact and accountability are agreed for each partnership.
Tell us where your IT team needs help or which requirements your customers are setting. Together, we determine which services fit and what a useful first step would be.