Security Governance

Version: 1.0 | Effective from: 1 January 2026

1. Purpose

This directive defines the rules for cybersecurity management in compliance with NIS2 and the Cybersecurity Act.

2. Scope

This directive applies to:

All information systems
All employees and contractors
All vendors with system access
Physical security of ICT

3. ISMS (Information Security Management System)

3.1 ISMS Structure

4. Asset Management

4.1 Asset Inventory

Every asset must be documented:

Field	Description
Asset ID	Unique identifier
Name	Descriptive name
Type	Hardware / Software / Data / Service
Responsible person	Who is responsible
Criticality	Critical / High / Medium / Low
Location	Physical/logical location
Classification	Confidential / Internal / Public

4.2 Asset Criticality

Level	Definition	RTO	RPO
Critical	Outage = business stop	<4h	<1h
High	Significant business impact	<8h	<4h
Medium	Limited impact	<24h	<8h
Low	Minimal impact	<72h	<24h

5. Technical Controls

5.1 Mandatory controls

Control	Requirement	Status
Encryption at rest	AES-256 for all data	Required
Encryption in transit	TLS 1.3 for all APIs	Required
Access Control	MFA + RBAC	Required
Patch Management	Critical <7 days, High <30 days	Required
Logging	Centralized SIEM, 1-year retention	Required
Backup	Daily, tested monthly	Required
Firewall	Perimeter + internal	Required
Antimalware	Endpoint protection	Required
IDS/IPS	Network intrusion detection	Recommended
DLP	Data Loss Prevention	Recommended

5.2 Encryption Standards

Type	Algorithm	Key Length
Symmetric	AES	256-bit
Asymmetric	RSA	4096-bit
Hashing	SHA	256-bit+
TLS	1.3	N/A

5.3 Access Control

Access Control Principles:

Least Privilege — minimum necessary permissions
Need-to-Know — access only to required data
Separation of Duties — division of responsibilities
MFA — for all admin accounts
Regular Review — quarterly access audit

6. Organizational Controls

6.1 HR Security

Phase	Control
Pre-employment	Background check (depending on position)
Onboarding	NDA, Security training, Policy acknowledgment
During employment	Regular training, Access reviews
Offboarding	Access removal (24h), Device return, Exit interview

6.2 Training Requirements

Role	Training	Frequency
All employees	Security awareness	Annually
All employees	Phishing simulation	Quarterly
IT staff	Technical security	Semi-annually
Developers	Secure coding	Semi-annually
Management	Security governance	Annually

7. Physical Security

7.1 Security zones

Zone	Description	Access
Public	Reception, lobby	Unrestricted
Office	Offices	Badge + PIN
Restricted	Server room, DC	Badge + PIN + biometrics
Highly Restricted	HSM, key storage	Dual control

7.2 Data Center Security

8. Vulnerability Management

8.1 Scanning Schedule

Type	Frequency	Scope
Network scan	Weekly	All subnets
Vulnerability scan	Monthly	All systems
Web app scan	Monthly	All web apps
Penetration test	Annually	Full scope

8.2 Patch Management SLA

Severity	SLA	Approval
Critical	7 days	Emergency change
High	30 days	Standard change
Medium	90 days	Standard change
Low	Next release	Standard change

9. Business Continuity

9.1 BCM Components

Component	Description
BIA	Business Impact Analysis
BCP	Business Continuity Plan
DRP	Disaster Recovery Plan
IRP	Incident Response Plan
CMP	Crisis Management Plan

9.2 Recovery Objectives

System	RTO	RPO
Production DB	4h	1h
Web services	2h	1h
Email	8h	4h
Internal apps	24h	8h

9.3 Testing Schedule

Test	Frequency
Backup restoration	Monthly
Failover test	Quarterly
DR drill	Semi-annually
Full BCP test	Annually

10. Vendor Security

10.1 Vendor Assessment

Before onboarding a vendor with data access:

10.2 Ongoing Monitoring

Activity	Frequency
Security review	Annually
Access audit	Quarterly
Incident review	On incident
Contract review	On renewal

11. Audit & Compliance

11.1 Audit Schedule

Type	Frequency	Scope
Internal audit	Quarterly	Rotating areas
External audit	Annually	Full ISMS
Compliance check	Semi-annually	NIS2, GDPR
Penetration test	Annually	Full scope

11.2 Certifications

Certification	Status	Validity
ISO 27001	Target	Q3 2026
SOC 2 Type II	Optional	—

12. Metrics & KPIs

KPI	Target	Measurement
Patch compliance	>95%	Monthly
Vulnerability remediation	<30 days (high)	Monthly
Security training completion	100%	Quarterly
Incident response time	<4h (critical)	On incident
MFA adoption	100% (admin)	Monthly

13. Policy Review

Monthly: Security metrics review
Quarterly: Policy effectiveness review
Annually: Full policy review + CISO approval

Next review: Q2 2026