MMultimediaFrom Lecce, across Italy
Contact us

MMultimedia / Services / MM Security

MM Security · cybersecurity suite

Six security products, one supplier

MM Security is our suite for protecting businesses: it monitors the network, encrypts data, collects suspicious events, finds weaknesses and makes backups that really can be restored. And behind it are people who read the alarms and step in. Software, configuration and support all come from MMultimedia: one point of contact, no third-party products to coordinate.

Ask for a proposal The ISO 27001 map

The suite

Each product covers one piece; together they make the system

The standard plan includes Network Monitoring, Logs and Events, Vulnerabilities, Backup and Managed Service; Encryption is added when laptops or protected media are involved. We start from what the company already has: we only propose what is new or more advanced.

What we need

The products one by one

What it does, what it spares you, what it proves

ISO/IEC 27001:2022 controls: 8.8direct contribution8.19supporting

MM Security Network Monitoring

Network monitoring software

What it does

Continuously monitors routers, the Internet connection and video surveillance. Detects traffic anomalies and sends alarms.

For security

  • A router that stops or generates unusual traffic is noticed straight away, not when someone complains.
  • Cameras that are switched off or disconnected are not left uncovered for days.
  • Alarms are the first sign of an attack in progress.

ISO/IEC 27001:2022

8.16
Monitoring activities
8.20
Security of networks
8.21
Security of network services
7.4
Physical security monitoring

Audit evidence: alarm log and network status reports.

MM Security Encryption

Data encryption software

What it does

Through MM Agent, it encrypts the disks of workstations and servers and removable media. It keeps recovery keys centrally and encrypted, continuously checks encryption status and flags non-compliant devices.

For security

  • A lost laptop or USB drive does not expose customer and employee data.
  • Recovery keys are not lost when an employee leaves the company.
  • You know at any moment which devices are not yet protected.

ISO/IEC 27001:2022

8.24
Use of cryptography
8.1
User endpoint devices
7.9
Security of assets off-premises
7.10
Storage media
7.14
Secure disposal or re-use of equipment

Audit evidence: encryption status per device and a list of the keys held.

MM Security Logs and Events (SIEM)

Security information and event management system

What it does

Through MM Agent, it gathers the logs of workstations and servers in a single system. It correlates them, applies detection rules and generates alarms and dashboards. It keeps logs for 12 months.

For security

  • Repeated failed logins and other suspicious behaviour become alarms, instead of staying hidden on individual computers.
  • After an incident you can reconstruct what happened, when and from which device.
  • Logs remain available even if a device is compromised.

ISO/IEC 27001:2022

8.15
Logging
8.16
Monitoring activities
5.25
Assessment and decision on information security events
5.28
Collection of evidence

Audit evidence: logs kept for 12 months, list of alarms and dashboards.

MM Security Vulnerabilities

Vulnerability management software

What it does

Through MM Agent, it keeps an inventory of the software installed on devices and continuously compares it with public vulnerabilities. It ranks weaknesses by risk and indicates corrective actions.

For security

  • Many attacks exploit known weaknesses for which an update already exists: knowing where they are is the first step to closing them.
  • Priorities tell you where to start.
  • The inventory also shows old or unauthorised programs.

ISO/IEC 27001:2022

8.8
Management of technical vulnerabilities
5.9
Inventory of assets
8.19
Installation of software
5.7
Threat intelligence

Audit evidence: software inventory, prioritised vulnerabilities and status of fixes. It also helps with risk assessment (clause 6.1.2).

MM Security Backup

Backup software for a new data protection architecture

What it does

Through MM Agent, it makes encrypted, scheduled copies of workstation data, checks the backup archives and runs restore tests.

For security

  • After ransomware, a failure or an accidental deletion, data can be recovered without paying a ransom.
  • Copies are encrypted: anyone who intercepts them cannot read them.
  • Restore tests tell you whether the backup really works, before you need it.

ISO/IEC 27001:2022

8.13
Information backup
5.30
ICT readiness for business continuity
5.29
Information security during disruption
8.24
Use of cryptography

Audit evidence: log of the backups performed and results of restore tests.

MM Security Managed Service

Ongoing configuration, monitoring and support

What it does

For 24 months MMultimedia staff configure the products purchased, analyse the alarms, adjust thresholds, assist the company during incidents and send a quarterly report. Critical alarms are taken charge of within 4 working hours.

For security

  • Tools generate alarms: you need someone to read them, discard false positives and step in.
  • In case of an incident the company knows who to call and is not left alone.
  • The quarterly report shows what happened and what to improve.

ISO/IEC 27001:2022

5.25
Assessment and decision on information security events
5.26
Response to information security incidents
5.24
Incident management planning and preparation
5.27
Learning from information security incidents
5.22
Monitoring and review of supplier services
8.16
Monitoring activities

Audit evidence: quarterly reports, alarms handled and response times. The report feeds monitoring (9.1) and management review (9.3).

ISO/IEC 27001

The map to the standard's controls

The Annex A controls of ISO/IEC 27001:2022 to which each product contributes. direct · supporting.

Control Network Encryption SIEM Vulnerabilities Backup Managed
Organisational controls
5.7 Threat intelligencesupporting
5.9 Inventory of assetsdirect
5.22 Monitoring of supplier servicessupporting
5.24 Incident preparationsupporting
5.25 Assessment of security eventssupportingdirect
5.26 Incident responsedirect
5.27 Learning from incidentssupporting
5.28 Collection of evidencesupporting
5.29 Security during disruptionsupporting
5.30 ICT readiness for business continuitydirect
Physical controls
7.4 Physical security monitoringsupporting
7.9 Off-premises assetssupporting
7.10 Storage mediasupporting
7.14 Secure disposal or re-use of equipmentsupporting
Technological controls
8.1 User endpoint devicesdirect
8.8 Technical vulnerabilitiesdirect
8.13 Information backupdirect
8.15 Loggingdirect
8.16 Monitoring activitiesdirectdirectsupporting
8.19 Software installationsupporting
8.20 Network securitydirect
8.21 Network services securitysupporting
8.24 Use of cryptographydirectsupporting
Management system requirements
6.1.2 Risk assessmentsupporting
9.1 Monitoring and measurementsupporting
9.3 Management reviewsupporting

No controls from group 6 (people): selection, confidentiality and training remain the company's responsibility. Control titles are abbreviated.

Useful for GDPR and NIS2 too

The same measures serve Article 32 of the GDPR (encryption, data recovery, periodic checks) and the risk management measures of NIS2 (incidents, business continuity, vulnerabilities, cryptography). NIS2, made simple →

Towards certification

Tools help, but certification is something else

ISO/IEC 27001 certifies the information security management system: how the company identifies risks, chooses measures and keeps them under control. MM Security brings the technical measures into that system, at three points.

  1. Risk analysis

    The priorities from Vulnerabilities and the alarms from Network and SIEM give concrete data on threats and weak points.

  2. Statement of Applicability

    The products become the measures adopted for the controls on the map.

  3. Audit

    Reports, logs and restore tests show the auditor that the controls work.

What else you need to get certified

  • Scope of the system and context of the company (clause 4)
  • Security policy, roles and responsibilities (clause 5)
  • Risk analysis and treatment, Statement of Applicability (6.1)
  • Competence, awareness and controlled documents (clause 7)
  • Internal audit and management review (9.2 and 9.3)
  • Nonconformities and continual improvement (clause 10)
  • Assessment by an accredited certification body

Controls the suite does not cover

  • Access and identity: accounts, privileges, multi-factor authentication (5.15-5.18, 8.2, 8.5)
  • Protection against malware (8.7): the antivirus in use stays
  • People: selection, confidentiality, training and awareness (group 6)
  • Physical security of premises and offices (group 7, except the points on the map)
  • Suppliers, legal requirements and privacy (5.19-5.23, 5.31-5.34)
  • Secure development, if the company develops software (8.25-8.34)

We look after access, antivirus and firewalls with our security services. MMultimedia is certified ISO/IEC 27001:2022 for the design of cybersecurity solutions and for ongoing configuration, monitoring and support services.

Voucher Cloud & Cybersecurity

MM Security is covered by the voucher: a non-repayable grant of 50% of eligible costs, up to €20,000 excluding VAT, if the application is approved, on a 24-month subscription with two annual fees paid in advance. We are on the official list of MIMIT (Italian Ministry of Enterprises and Made in Italy) suppliers (ID VCCFA2600000760).

The voucher funds software tools and managed services, not consultancy to build the management system, training or the certification audit. The Managed Service stays within 30% of the plan, as the call requires, and covers only the products purchased.

How the voucher works

To prepare the proposal

We need only a few details

Products and amounts are chosen based on the company's actual equipment. To get started:

Ask for a proposal

Questions

What people ask us most often

Does MM Security make my company ISO 27001 certified?

No, and be wary of anyone who promises it. Certification concerns the company's management system and is issued by an accredited body. MM Security covers part of the technical controls and produces the evidence to show the auditor: an important piece of the journey, but not all of it.

Do I have to buy all six products?

No. The standard plan includes five, and encryption is added when needed. If you already have a tool that works, we keep it: we only propose what is new or more advanced than what you use.

Do I need to buy hardware?

No. The suite is made up of software and managed services: it works on the computers, servers and network devices the company already has, through our MM Agent.

Is storage space for backup copies included?

The backup software is; cloud storage space is not, because it is not covered by the voucher. We list it separately in the proposal.

Who reads the alarms?

MMultimedia staff, through the Managed Service: we analyse the alarms, discard false positives, adjust thresholds and step in. Critical alarms are taken charge of within 4 working hours, and you receive a report every three months.

Tell us where you are starting from

How many computers, which security tools you already have, whether an ISO 27001 or NIS2 programme is under way. We reply within 2 hours during office hours, with a tailored proposal.

Contact us All security services

For information only: it does not replace the standard or the call. The map shows which ISO/IEC 27001:2022 controls the products contribute to, not the company's compliance or certification: applicable controls are chosen through risk analysis. Sources: ISO/IEC 27001:2022 and Annex A, Ministerial Decree of 18 July 2025, Directorial Decree of 4 August 2026, MIMIT FAQ. Updated on 9 November 2026.