Cybersecurity & Compliance
Critical infrastructure protection, compliance with NIS2 and ISO/IEC 27001. No auditor-checkbox approach — real defense that holds against real attacks.
What it is and who needs it
Cybersecurity is not "buy antivirus and SIEM". It is an organizational discipline starting with threat modeling, going through architectural decisions (Zero Trust, segmentation, IAM) and ending with operational processes (incident response, threat hunting, regular audit).
Regulatory compliance (NIS2, ISO/IEC 27001, GDPR) is a separate competency at risk of becoming an "auditor checkbox". We combine both worlds: technically reliable defense that simultaneously passes formal compliance.
Signals that tools alone no longer hold security
- You are a critical infrastructure operator under NIS2.
- ISO/IEC 27001 audit or KSZI certification is approaching.
- You have legacy systems that cannot be "rewritten to Zero Trust".
- A SOC exists but produces no real alerts — only noise.
- Regulatory incident response queries take days instead of hours.
Less audit theater, more real resilience
The cybersecurity page sells not a certificate, but the ability to survive an incident: detect, contain, recover and prove control to the regulator.
CISO, compliance and operations speak different languages
Tools may be purchased, but if access review, incident response and ownership do not live in processes, defense remains a facade.
Threat model before a new platform purchase
We start with assets, attack scenarios and control gap analysis. Only then decide what to buy, tune or change organizationally.
Why we do this differently
Zero Trust for legacy is not migration — it is adaptation. Attempts to "rewrite legacy to Zero Trust" fail in 9 out of 10 cases.
Instead of rewriting legacy, we wrap it in defense layers: identity-aware proxy, micro-segmentation, enhanced traffic monitoring. This is not "true" Zero Trust, but it works.
ISO/IEC 27001 certification without operational maturity is just paper. Paper that breaks at the first real attack.
We do not do "certification in 2 months" — that is cosmetic. We do 6–9 month implementations, after which certification becomes a natural next step.
If your SOC produces >50 alerts a day — it does not work. It trains analysts to ignore alerts.
Before scaling a SOC, we optimize the noise ratio. Target state — 5–10 actionable alerts per day, each one actually reviewed by an analyst.
When you need this — and when you don't
It is more honest to say "you do not need this yet" than to sell an engagement that will not deliver ROI.
✓ Need it
- Critical infrastructure operator under NIS2
- Financial sector with NBU/ECB requirements
- Public sector with KSZI requirements
- Grew to >500 staff with outdated IAM
- ISO/IEC 27001 audit ahead
✗ Not yet
- Small business without regulatory requirements
- You want a certificate "checkmark" without real changes
- Not ready to assign a security owner for 50%+ of their time
- Looking for a silver bullet — one platform that "solves security"
How we run the engagement
Security assessment ·
Asset and data inventory, threat modeling, IAM audit, gap analysis of existing controls against ISO/IEC 27001 / NIS2 baseline.
Architectural recommendations ·
Roadmap for Zero Trust (where realistic), segmentation strategy, IAM modernization, SIEM/SOAR tuning. With effort estimates and prioritization.
Quick wins ·
MFA enforcement, privileged access management, basic segmentation, SOC noise reduction. No architectural changes — closing the most obvious gaps.
Compliance implementation ·
ISMS documentation, controls, audit trail, regular reviews. Prepares for ISO/IEC 27001 certification or NIS2 compliance.
Continuous operations ·
Threat hunting, periodic penetration testing, incident response drills, threat model updates. Without this, compliance degrades within 12 months.
Project lead: Softline (cybersecurity, compliance).
Brought in when needed: SL Global Service (security in cloud), IQusion (public sector), Softengi (AI-based threat detection).
Typical mistakes we have seen projects fail on
Buying a SIEM as "the security solution"
The client buys an enterprise SIEM expecting it to catch incidents on its own. Six months later — 500 alerts a day, 99% false positives. Analysts ignore everything.
What we do instead: SIEM tuning before production — mandatory 4–6 weeks. Target state: <10 alerts/day with actionable rate >50%.
Zero Trust as a legacy rewrite
The team reads a Forrester report on Zero Trust and starts rewriting the ERP. The project takes 2 years, budget ×3, result — half migrated, half is the old architecture with friction at the boundary.
What we do instead: for legacy — Zero Trust as a wrapper (identity-aware proxy + micro-segmentation), not a rewrite. Rewrite is a separate decision with its own ROI case.
Certification without operational change
Consultants write policy documents, pass the audit, get the certificate. Six months later, the documents reflect nothing real that is actually happening.
What we do instead: first implementation (6–9 months), then certification. Documents follow real processes, not the reverse.
IAM as "Active Directory configuration"
After 5 years of company growth, each employee has 30+ permissions, of which only 5 are actually used. A terminated employee retains access for 3 months after leaving.
What we do instead: periodic access review (quarterly), role-based access as default, off-boarding automation via HR trigger.
Typical scenarios from our practice
Each example shows the client-side story: what was getting in the way, what changed, and what result the team got.
Order in security requirements
- Problem
- Requirements were scattered across IT, operations, and audit teams.
- What we did
- We put risks into one map and defined who owns each control.
- Result
- The team got a clear protection and audit-readiness plan.
Protecting old systems without stopping business
- Problem
- Critical systems could not be replaced quickly, but they still had to be protected.
- What we did
- We limited access, added action control, and introduced changes step by step.
- Result
- Risk was reduced without a major work stoppage.
Preparing for an official review
- Problem
- The system had to handle sensitive data, but security processes were informal.
- What we did
- We documented rules, closed gaps, and prepared the team for regular checks.
- Result
- The system passed review and gained a clear support routine.
Articles on this topic
Nine recent expert articles — from thematic overviews to specific architectural decisions.
No articles in this category yet.
Technologies we work with
SIEM/SOAR
Splunk · Microsoft Sentinel · IBM QRadar · ArcSight · LogRhythm · Elastic Security
IAM & PAM
Okta · Microsoft Entra ID · Ping Identity · CyberArk · BeyondTrust · HashiCorp Vault
Network security
Cisco Firepower · Palo Alto · Fortinet · Cloudflare Zero Trust · Zscaler
Endpoint & XDR
CrowdStrike · SentinelOne · Microsoft Defender for Endpoint · Carbon Black
Vulnerability management
Tenable · Qualys · Rapid7 · OWASP ZAP · Burp Suite
Standards
ISO/IEC 27001 · NIS2 · GDPR · NIST CSF · CIS Controls · КСЗІ
Frequently asked questions
When does NIS2 apply and who is affected?
NIS2 is EU Directive 2022/2555, in force since October 17, 2024. Applies to operators of critical infrastructure: energy, transport, banking, healthcare, digital services, water supply, waste, food industry, manufacturing, digital infrastructure. Mandatory for Ukrainian companies doing business in the EU.
How much does ISO/IEC 27001 certification cost?
The certification itself (audit) — from $15k to $50k depending on organization size. Implementation that precedes certification — $100k–$500k+ depending on current security state. Certification is impossible without implementation.
Is a SOC needed if there is a SIEM?
SIEM is a tool that collects logs and generates alerts. SOC is the team of people that responds. Without SOC, your SIEM is an expensive dashboard nobody reviews. In 2026, a typical enterprise has: SIEM + in-house L1/L2 team + outsourced L3 for complex incidents.
What is KSZI and when is it needed?
KSZI is the comprehensive information protection system, a Ukrainian legal requirement for government information systems handling restricted-access data. If you integrate with government registries or process government data — KSZI attestation is mandatory.
What does Zero Trust look like for an organization with legacy ERP?
Not as a rewrite. As a layered approach: (1) identity-aware proxy in front of legacy; (2) micro-segmentation at network level; (3) enhanced audit logging; (4) JIT access via PAM. This is 60–70% of Zero Trust benefit without legacy code changes.
What to do after detecting an incident?
Standard flow: detect → contain (isolation) → eradicate (threat removal) → recover → lessons learned. The first 24 hours are critical — damage scope depends on this. NIS2 requires initial notification to the regulator within 24 hours of detection.
Related competencies
Real projects rarely fit in one competency. See which other areas we work in.
Let's discuss your security situation — we will suggest where to start
30-minute discovery call with a security architect. No commitments and no NDA at this stage.
Intecracy Group does not force a single delivery team. We clarify the task, identify the required competencies and help involve the relevant alliance members.