Access separation
Personal accounts instead of shared ones, rights by job role, regular review of who is authorised.
The measures are chosen to match the assigned protection level. We do not implement anything superfluous: excessive protection gets in the way of work and adds nothing to compliance.
Personal accounts instead of shared ones, rights by job role, regular review of who is authorised.
Recording access to the data and retaining the logs. Without it an incident cannot be investigated.
The servers and databases where the data physically sits: segment isolation, restricted network access.
Protection of data leaving the controlled zone, including remote employees and branch offices.
Restrictions on removable media, printing and sending attachments wherever that is justified.
Copies of the data with restore testing and protection of the copies themselves against ransomware.
We implement in stages, starting with the measures that give the greatest effect and do not get in the way of work.
We classify the system and obtain the list of mandatory measures. From then on we work strictly to it.
We remove shared accounts, switch on logging and put the permissions in order. It takes days and the effect is large.
Network segmentation, perimeter protection, channel encryption, control over removable media.
We check that the measures work: we try to gain access where there should be none and look at the logs.
The most common finding during a survey is shared accounts. Five people know the password to the accounting database, and it is fundamentally impossible to determine who exported the data. This is closed in a day and satisfies several requirements at once.
Usually not. For the third and fourth protection levels most of the requirements are met by configuring what you already have: operating systems, network equipment, antivirus. Purchases are needed only in specific spots.
Well configured protection is invisible to anyone working by the rules. Restrictions are applied where they belong: control over removable drives is needed by the accounts and HR departments, not by the whole company.
By testing. We try to reach the data from an account that should not have access, take a test file out and check whether it showed up in the logs. We document the result in a report.
Tell us where employee and client data is stored. We will look at what is already protected and what is exposed.
Request received
We can already see it. We will reply within one business day, and for urgent matters we will bring in the on-duty engineer right away.
City not found. Please check the spelling.