Cybersecurity Compliance Programme
Cybersecurity is no longer a matter for the IT team alone. The Cybersecurity Law, which entered into force in 2025, places direct legal obligations on companies, such as reporting cyber incidents, providing the information and documents requested by the Cybersecurity Directorate and documenting their security measures. Breaches of these obligations carry administrative fines and, in some cases, prison sentences. For companies providing critical infrastructure services, the obligations are heavier still.
A cyber incident rarely begins with a sophisticated attack. It begins with a gap nobody owns: an old server missing from the inventory, a supplier whose remote access was never revoked, a backup that has never been tested, a team that does not know who should inform whom when something happens. This programme is designed to make those points visible at asset-inventory level and close them legally and organisationally.
Stages
Training, interviews and current state review
Management and the relevant teams are given training on the Cybersecurity Law and information security, after which the relevant departments, IT first among them, are interviewed individually. An inventory of information assets covering hardware, software, network, data and people is produced, the criticality of each asset group is established, and existing documents and processes are reviewed.
Gap and risk assessment
The current state is compared against the measures in the Information and Communication Security Guide in a gap analysis; the controls reported are verified in practice together with the IT team, and risks are prioritised. A Risk and Action Report is prepared and presented to management, and an implementation roadmap is drawn up.
Compliance
The information security policy and procedures are prepared or updated; cybersecurity and confidentiality clauses are added to supplier, service and employment agreements; technical and organisational measures are documented; and the cyber incident response and notification process is set up, making clear who notifies which authority and within what time.
Closing and audit
Once the compliance stage is complete, the actions on the roadmap are checked and a closing report is prepared. After the programme ends, an audit and a tabletop exercise testing the incident response process are carried out, and the results are set out in a separate audit and exercise report.
Areas Reviewed
- Obligations under the Cybersecurity Law
- Measures in the Information and Communication Security Guide
- Information asset inventory and criticality levels
- Access and authorisation management
- Supplier and third-party access
- Cyber incident response and notification
- Backup and business continuity
- Log management and monitoring
- ISO 27001 and information security management
- Overlap with KVKK and data breach notification
Deliverables
- Information asset inventory and criticality classification
- Gap Analysis Report
- Risk and Action Report
- Management presentation and implementation roadmap
- Information security policy
- Cyber incident response and notification procedure
- Access management, backup and log management procedures
- Cybersecurity clauses for supplier and service agreements
- Documentation of technical and organisational measures
- Closing and Audit Report
- Exercise scenario and exercise report
- Training decks
Frequently Asked Questions
Which companies does the Cybersecurity Law apply to?
The Law is not limited to public bodies; it also covers individuals and legal entities operating in cyberspace. How heavy the obligations are depends on the company's position: for companies providing services in critical infrastructure sectors such as energy, finance, transport, electronic communications and health, they increase markedly. The first step of the programme is to establish which obligations the company is subject to.
How does this differ from the Data Protection Compliance Programme, and can the two run together?
The Data Protection Compliance Programme focuses on personal data; the Cybersecurity Compliance Programme covers all of the company's information assets, systems and service continuity, whether personal data is involved or not. The two overlap in places: the asset and data inventory, technical measures, and breach and incident notification. Run together, the interviews and inventory work are done once, and notification processes are set up to satisfy both regimes.
Do you carry out penetration tests or other technical security tests?
No. Penetration tests and similar technical tests are carried out by the company's IT team or by specialist cybersecurity firms. The programme covers identifying the legal obligations, documenting controls, policies and agreements, and the incident response process. When controls are verified, we work together with the company's technical team and, where there is one, its external service provider.
What do we need to do when a cyber incident happens?
Most time is lost in an incident when it is unclear who decides and who must be informed. The Cyber Incident Response and Notification Procedure prepared at the end of the programme defines detection, first response, decision-making authority and the notifications to be made, with their deadlines, to the Cybersecurity Directorate and, where personal data is affected, to the Personal Data Protection Board. The exercise is there to test that the procedure works beyond paper.
Would you like to run this programme at your company? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meeting