The Cybersecurity Act in practice: How to handle the lower-tier obligations

About the webinar

Registering a regulated service under the Cybersecurity Act is only the first step. Once your registration is confirmed, a one-year clock starts running, during which you must gradually implement security measures. Even under the lower regime there are quite a few of them, and they can't be put in place overnight: management responsibility, a responsible person, business continuity, incidents, and more.

On top of that, many companies are dealing with this for the first time – the new Cybersecurity Act has significantly expanded the range of regulated entities, so you may fall under it even if you'd never dealt with cybersecurity before. That makes it all the more important to approach the measures in a functional way and not turn it into a paper exercise. Measures that exist only in documents and don't match real operations won't help you during an inspection or an incident.

In the webinar, we'll walk through what specifically to set up after registration, how to go about it practically without needlessly complex methodologies, and what to prepare so you can demonstrate compliance at any time.

Agenda

• How and where to start: the first steps after registration
• Essential measures under the lower obligations: the mandatory minimum – roles and responsibilities, an overview of security measures, assets and risks, suppliers, people, continuity and incidents
• Measures subject to assessment under the lower obligations: measures where you assess the extent and relevance of implementation yourself – access, detection, network and application security, and cryptography.