ISMS, Best Practices, Plans

In the field of Security Incident and Events Prevention, we draft and update Information Security Management System (ISMS) in accordance with legal regulations, standards (Best Practices, Best Effort) and outputs from SIEM and SOAR. We design Response incident and event plans and related documentation.

Incident/Events Identification, Defence, Remedy

Our consultancy includes the identification of a Security Incident or Event, including the evaluation of its severity. This is followed by appropriate defence and remedies, always in cooperation with ICT specialists and, if necessary, with the relevant supervisory authorities.

Security Incidents Reporting, Investigation Support, Evaluation

We cooperate to report Security incidents that have or may have an impact on the security of the data or information systems of the compromised entity to the supervisory authorities (CERT/CSIRT) and selected third parties. We legally support compromised entities in relevant investigations, until final completion and appropriate evaluation.

GAP Analysis, Draft, Implementation

In the context of the new Directive (EU) 2022/2555 of the European Parliament and of the Council on measures to ensure a high common level of cyber security across the Union (NIS 2) and the preparation of the new Cybersecurity Act (including implementing decrees), we provide comprehensive services, including identification of future obliged entities (so called providers of a regulated service), assessment of managerial responsibility or proposal/revision of ISMS. Based on a comprehensive GAP analysis, we propose effective solutions and assist in the preparation of organizational, operational and technical measures (internal or external SOC, etc.), including their implementation.

Risk Management, Management Policy, New Suppliers

We support obliged entities under the existing and upcoming new Cybers Security Act (following the transposition of the NIS 2 Directive) in implementing supply chain risk management (technical and organizational measures, assessing the credibility of suppliers, distinguishing between common and major suppliers, etc.). We also provide legal services to entities that are already or plan to be suppliers of obliged entities (e.g. updating contractual documentation, testing, questionnaires).

Insurance Coverage Scope, Cyber-Insurance, Consultation

We identify the existing scope of insurance coverage (liability insurance, D&O insurance for statutory bodies). We assist in the preparation of documents for arranging cyber-risk insurance (Cyber-insurance, Cyber-risk), as stand-alone or add-on insurance. We also provide consultations on the content of the insurance policy for cyber risk (policy exclusions, limits), focusing on the scope of compensation for damage caused to the insured (e.g. costs associated with disruption or interruption of operations, hacker attack, blackmail, regulatory proceedings or GDPR sanctions) and third parties (e.g. privacy, lost profits or renewal costs).

Legal Requirements Review, Registration, Review

We verify compliance with the legal requirements for registration in the catalogue of cloud computing service providers in public administration, as maintained by the Ministry of the Interior of the Czech Republic (https://www.mvcr.cz/clanek/katalog-cloud-computingu.aspx?q=Y2hudW09Mg%3d%3d)

We set up the processes necessary for such registration and provide already registered providers with continuous consultancy, including checks on the fulfilment of existing and new obligations.=<