cybrx

//Services

Cybersecurity & compliance services

Every engagement is tailored to your size, industry and goals. Start with a single service or combine them into a complete security programme.

NIS2 Compliance

The EU NIS2 Directive raises the bar for thousands of mid-sized companies and their suppliers. We assess whether and how it applies to your organisation, compare where you are today with the requirements and guide you step by step to compliance — in language your management can turn into decisions.

Discuss this service

What you get

  • Applicability and scope assessment (essential vs. important entity)
  • Gap analysis against the NIS2 risk-management measures
  • Prioritised compliance roadmap with effort estimates
  • Incident handling and reporting process (24h / 72h / 1 month)
  • Supply-chain and supplier security requirements
  • Cybersecurity awareness session for management

Cyber Risk Management

Not every risk can be eliminated, but every significant risk should be known, owned and managed. We build a cyber risk management process aligned with ISO/IEC 27005 and NIST, translate technical threats into financial and operational impact, and give management a clear picture to decide on. Risk analysis is a core requirement of NIS2 and of the legal framework in the Republic of Moldova (Law No. 48/2023 and Government Decision No. 562/2025).

Discuss this service

What you get

  • Risk assessment methodology and risk appetite tailored to your organisation
  • Cyber risk register with owners and deadlines
  • Risk assessment of critical processes and systems
  • Risk treatment plan, prioritised by impact and cost
  • Supplier and third-party risk assessment
  • Regular risk reporting to management

Compliance Readiness: ISO 27001, ISAE 3402, IEC 62443

Large clients, EU partners and tenders increasingly ask for independent proof of security. We help you choose the right standard and arrive at the audit prepared: ISO/IEC 27001 for an information security management system, ISAE 3402 for an assurance report on the controls of a service organisation (Type I or Type II), and IEC 62443 for the security of industrial automation and control systems (OT). We prepare your organisation; the final audit and certification are carried out by an independent auditor or certification body.

Discuss this service

What you get

  • Choice of standard and scope definition, based on your clients and goals
  • Gap analysis against ISO 27001:2022, ISAE 3402 or IEC 62443
  • ISO 27001: ISMS, risk assessment and Statement of Applicability
  • ISAE 3402: system description, control objectives and evidence for Type I / Type II
  • IEC 62443: zones and conduits, security levels and an OT security programme
  • Internal audit, team preparation and support during the external audit

Security Architecture Review

Most incidents exploit design weaknesses, not exotic vulnerabilities. We review your architecture — cloud, Microsoft 365, network, devices and applications — against best practice and zero-trust principles, and give you a practical list of what to fix first.

Discuss this service

What you get

  • Cloud and Microsoft 365 / Azure configuration review
  • Network segmentation and exposure review
  • Zero-trust maturity assessment
  • Threat modelling for critical systems
  • Findings report ranked by risk and effort
  • Remediation follow-up session

Business Continuity & Disaster Recovery

When systems go down, every hour counts. We help you understand which processes matter most and how long you can afford to be offline, and build continuity and recovery plans your team has actually rehearsed.

Discuss this service

What you get

  • Business impact analysis (BIA)
  • Recovery objectives (RTO / RPO) for each critical system
  • Business continuity plan (BCP)
  • Disaster recovery plan and ransomware-resilient backup strategy
  • Tabletop exercises with your team
  • Regular review and maintenance of the plans

Identity & Access Management

Compromised accounts are the most common way in for attackers. We design and harden how you manage identities, drawing on deep Microsoft Entra ID experience, so access is secure, auditable and easy to use.

Discuss this service

What you get

  • Identity and access maturity assessment
  • Multi-factor authentication and Conditional Access design
  • Least privilege and privileged access management (PAM)
  • Joiner, mover and leaver processes
  • Periodic access reviews
  • Single sign-on and identity governance roadmap

Cyber Awareness

Most attacks start with a person: a phishing email, a reused password, a convincing phone call. We build awareness programmes tailored to every role in the company — from management to front-line staff — with real examples, in your team's language, and measure progress over time. Staff training is also an explicit requirement in NIS2 and ISO 27001.

Discuss this service

What you get

  • Assessment of the current awareness level
  • Interactive employee training in Romanian, Russian or English
  • Dedicated sessions for management on risks and responsibilities
  • Phishing simulation campaigns with results reporting
  • Short materials: guides, posters and regular micro-lessons
  • Progress indicators and a report for management

Virtual CISO

Not every company needs, or can find, a full-time Chief Information Security Officer. As your virtual CISO, we run your security programme part-time: we set priorities, report to management, handle auditors and client questionnaires, and keep compliance on track.

Discuss this service

What you get

  • Security strategy and annual plan
  • Regular reporting to management and the board
  • Policy management and compliance tracking
  • Client security questionnaires and audits
  • Oversight of supplier and third-party risk
  • Flexible monthly engagement

Not sure where to start?

Book a free, no-obligation consultation. We'll discuss your situation and tell you honestly what you need — and what you don't.

Book a free consultation