What is included

The measures are chosen to match the assigned protection level. We do not implement anything superfluous: excessive protection gets in the way of work and adds nothing to compliance.

Discuss the scope

Access separation

Personal accounts instead of shared ones, rights by job role, regular review of who is authorised.

Logging

Recording access to the data and retaining the logs. Without it an incident cannot be investigated.

Protection of storage

The servers and databases where the data physically sits: segment isolation, restricted network access.

Channel encryption

Protection of data leaving the controlled zone, including remote employees and branch offices.

Control over data leaving

Restrictions on removable media, printing and sending attachments wherever that is justified.

Backups

Copies of the data with restore testing and protection of the copies themselves against ransomware.

How the work runs

We implement in stages, starting with the measures that give the greatest effect and do not get in the way of work.

01

Determining the level

We classify the system and obtain the list of mandatory measures. From then on we work strictly to it.

02

Quick measures

We remove shared accounts, switch on logging and put the permissions in order. It takes days and the effect is large.

03

Infrastructure measures

Network segmentation, perimeter protection, channel encryption, control over removable media.

04

Verification

We check that the measures work: we try to gain access where there should be none and look at the logs.

The most common finding during a survey is shared accounts. Five people know the password to the accounting database, and it is fundamentally impossible to determine who exported the data. This is closed in a day and satisfies several requirements at once.

Frequently asked questions

Usually not. For the third and fourth protection levels most of the requirements are met by configuring what you already have: operating systems, network equipment, antivirus. Purchases are needed only in specific spots.

Well configured protection is invisible to anyone working by the rules. Restrictions are applied where they belong: control over removable drives is needed by the accounts and HR departments, not by the whole company.

By testing. We try to reach the data from an account that should not have access, take a test file out and check whether it showed up in the logs. We document the result in a report.

We will protect personal data

Tell us where employee and client data is stored. We will look at what is already protected and what is exposed.