Cybersecurity and Data Security

We help the Client establish whether it falls within the scope of the Cyber Resilience Act (CRA) and, if so, comply with it. We take account of the type of products with digital elements the Client makes or distributes and of its role in the supply chain, and the work may cover individual product lines or the entire portfolio. Where requested, our first deliverable is a gap analysis against the applicable cybersecurity requirements, in which we identify the shortfalls in product security and vulnerability handling, define the action plan and corrective measures and support the Client with the documentation and conformity obligations laid down by the Regulation.

See the dedicated section

We support businesses within its scope in complying with the DORA Regulation on digital operational resilience in the provision of financial services. We tailor the service to the Client’s role (financial entity or ICT service provider to financial entities) and to the complexity of its technology landscape, working on individual areas or on the entire resilience framework. We carry out a gap analysis against the requirements of the Regulation, assess the ICT risk management system, the testing and incident reporting arrangements and the management of relationships with critical ICT third-party service providers, and define the resulting action plan and corrective measures. The priority is a compliant, well-governed operational resilience framework that reduces exposure to incidents, claims and sanctions and strengthens the continuity of financial services.

We advise on putting in place security measures to protect data. The service is tailored to the nature of the data processed, the Client’s technology landscape and its sector, and can cover individual processing operations or the entire information system. We identify the appropriate technical and organisational measures, including for the purposes of Article 32 GDPR, define incident and breach management procedures, support the selection and configuration of protection solutions (access controls, encryption, backup) and verify their effectiveness over time. We also prepare the procedures for managing incidents and personal data breaches (Articles 33 and 34 GDPR), the policies on the use of company tools and the rules on IT authentication and credential management, covering the secure storage of passwords, data encryption and the other applicable technical controls.

We deliver staff awareness sessions on cybersecurity, aimed at individual functions or at the entire company population. Awareness programmes can be linked to phishing simulation campaigns run with ethical hacking techniques and supplemented by support in monitoring risky behaviour, measuring the level of awareness achieved and defining the resulting corrective and training actions. We furthermore offer drafting of learning materials (e.g. awareness raising materials, simulations of possible scenarios with fictional characters, legal text easily accessible via hypertext) which can also be uploaded into e-learning platforms including animations, sounds, multiple answers questions and randomized answers.
We also offer a range of “ready-to-go” solutions, thanks to a consolidated collaboration with our technological partner Mediamed Interactive, which allows us to offer to our Clients a product based on the more evolved and widespread training platforms, so that our Clients can enjoy both standard sessions or more tailored sessions.
The value of awareness work is that it reduces the human risk factor — often the main vector of incidents — while strengthening the security culture and the overall soundness of the control system.

We support the Client in designating system administrators, collecting and analysing access logs and defining methodologies for verifying compliance with the instructions given and with the obligations laid down by the Garante’s decision on system administrators, identifying any anomalies and defining corrective actions. Periodically reviewing the work of system administrators reduces exposure to misuse, claims and sanctions and strengthens the overall soundness of the control system.

We can assist the Client in assessing the security of individual applications that process personal data. The service is tailored to the number and criticality of the applications and to the Client’s sector and can cover individual applications or the entire application estate. We assess the security measures adopted using dedicated checklists, identify the gaps against the ENISA guidelines and the ISO/IEC 27001:2022 standard and define the priorities for action and the corrective measures. Analyses like these offer a clear picture of the level of application security and a sustainable improvement plan, reducing exposure to vulnerabilities, claims and sanctions and strengthening the overall soundness of the control system.

We are equipped to support the implementation of the principle of data protection and security by design (Article 25 GDPR). Work in this area is carried out in synergy with the Client and any of its suppliers and takes account of the nature of the project, the IT context and the Client’s sector. We can support individual initiatives or the entire product and service development cycle. Our work typically includes the feasibility assessment, the analysis of the technology context and data flows, the identification of the technical and organisational solutions to adopt from the earliest stages and support with implementation. The value of data protection by design is that it prevents critical issues and later remediation costs and gives the Client a robust, accountability-oriented framework, reducing exposure to claims and sanctions and making products and services compliant from the outset.

We work alongside the Client in handling cybersecurity issues and incidents through ongoing assistance. The service can cover a single event or a standing incident response arrangement. We provide a dedicated hotline and support the technical analysis of the attack, the prompt adoption of containment and recovery actions and the management of personal data breaches, taking care of the assessments and notifications required by Articles 33 and 34 GDPR. Ongoing interaction with the Client in this area makes for a rapid, coordinated response to incidents, limits damage, reduces exposure to claims and sanctions and strengthens the organisation’s overall resilience.

We advise on putting in place business continuity and disaster recovery procedures. We analyse critical processes and their impacts (business impact analysis), define continuity and recovery strategies, prepare the business continuity and disaster recovery plans required by the legislation — including in alignment with the ISO 22301 standard — and support their periodic testing. While the primary objective for the Client is to strengthen its overall resilience, achieving a sound ability to react and resume operations in the event of a security incident, solid, well-targeted work in these areas also has the advantage of reducing exposure to claims and sanctions.

For cybersecurity and data security, the Legal Desk service offered by netforLegaL has a strong operational focus. As with our legal assistance, our goal is to ensure that the Client can count on our availability and, above all, our speed always. The service meets the need to outsource the handling of legal issues in less complex business contexts and can also be a valuable support to the in-house legal department in more structured organisations.
The involvement of a pool of senior professionals — organised by area of specialisation — allows the Client to capitalise on the advisory experience gained, ensuring constant regulatory updates in its sector. The multidisciplinary approach also delivers attractive economies of scale.

Our areas of work include:

• Compliance with the security measures under Article 32 GDPR and with security by design principles;
• Support with compliance with the cybersecurity regulatory frameworks (CRA, NIS2, DORA);
• Security assessment of external suppliers and review of the work of System Administrators;
• Security assessment of applications and information systems;
• Cybersecurity awareness and staff training;
• Data breach management and dedicated hotlines;
• Business continuity and disaster recovery (ISO 22301).

For each Client the service involves a “contact lawyer”, who coordinates the work and has an ongoing relationship with the company. The presence of this figure brings:

• A stronger relationship of trust with the Client;
• The progressive personalisation of the service, as knowledge of the company context steadily grows;
• The guarantee of a constant legal presence, which also plays a proactive role towards the Client.

As for how the service is offered, the methodology is that of a typical help desk: maximum freedom and flexibility for the Client to set upfront an annual budget for the initiative, to make the most of its economies of scale.
The expected result is to turn what has perhaps been perceived until now as the cost of regulatory compliance into an insurance policy — or an investment — in the peace of mind of doing things properly.