Cybersecurity
Cybersecurity: stock and serial tracking, sales and e-commerce, service and reporting.
Challenges
- Penetration test findings stay in a report file and their closure is never tracked.
- The committed incident response time is never measured.
- Continuous monitoring subscriptions and project work get mixed together.
- The confidentiality agreement and granted access rights are not recorded.
Workflows
Penetration test project
- Scope and the confidentiality agreement are signed and access rights are recorded.
- Findings are recorded with a severity level and assigned to an owner.
- Closed findings are verified and a closure report is produced.
Monitoring subscription and incident response
- The continuous monitoring subscription is set up with a period fee.
- When an incident is reported the response clock starts running.
- Breaching the time limit raises an alert and SLA performance is reported.
Documents
- Sales invoice
- Confidentiality agreement
- Finding (vulnerability) record
- Incident response report
Reports
- Finding status and closure
- SLA compliance performance
- Split of subscription and project revenue
- Working hours by staff member
Metrics
- Finding closure time
- SLA compliance rate
- Share of subscription revenue
- Project cost variance
Compliance
- Information security management standard
- Data processing agreement
- Incident notification obligation
- Kvkk
Glossary
- Finding (vulnerability)
- Work record with a severity level
- Incident response time
- Contractually committed response time
- Continuous monitoring
- Recurring subscription invoice
- Confidentiality agreement
- Permission record attached to a document
Frequently Asked Questions
Can I track the closure of findings?
Yes — each finding is assigned to an owner with a severity level and its closure is verified.
Can I measure the response time?
Yes — the time from incident report to resolution is measured against the commitment.
Can I separate subscription revenue from project revenue?
Yes — the monitoring subscription and project work are reported as separate revenue lines.
Can I link audit evidence to the customer?
Yes, reports and evidence files are stored in the document archive of the customer record.
Can I prioritise findings by severity?
Yes, every finding is raised with a severity level and critical ones move to the top of the priority list.
