Case study · Public sector
Cyber resilience for the Moravian-Silesian Region
Audit, penetration testing, and NIS2 readiness. Public administration manages citizens’ sensitive data and provides services that hospitals, schools, and social care facilities rely on to keep running. That is why an attack on a single organization in this ecosystem never stays isolated—it affects thousands of people who depend on that service. With the arrival of the NIS2 Directive, which requires organizations to demonstrably manage cybersecurity and report incidents, the Moravian-Silesian Region needed a realistic and comprehensive picture of its resilience. It brought this challenge to XEVOS.
4
areas of work, from audit to ongoing support
NIS2
preparation for obligations under the new regulation
ISO 27001
documentation framework alongside NIS2
Pentera
automated yet realistic penetration testing
About the client
A client responsible for dozens of organizations
The Moravian-Silesian Region is one of the largest regional governments in the Czech Republic. The Regional Authority oversees dozens of publicly funded organizations, including schools, hospitals, and social care facilities.
This means that a security incident at any one of them affects not only the authority itself but, above all, the services these organizations provide to citizens. On top of that, with the arrival of NIS2, what used to be “good practice” is becoming a legal obligation.
Client profile
Industry
Public sector, regional government
Presence
Moravian-Silesian Region, dozens of publicly funded organizations
What it does
Regional Authority overseeing schools, hospitals, and social care facilities
Partnership with XEVOS
Audit, penetration testing, NIS2 strategy, and employee training
Challenge
From paper to practice
The region approached XEVOS with four interrelated requirements.
Real-world verification
Above all, it needed a realistic picture of its current level of security—not just on paper (in documentation and policies) but verified in practice through penetration testing.
NIS2 readiness
At the same time, it had to prepare for the obligations arising from NIS2 and the new Czech Cybersecurity Act, which apply directly to regional governments.
The human factor
The third area was raising employees’ awareness of phishing, social engineering, and good security hygiene when handling sensitive data. After all, the human factor plays a key role in public-sector security.
Long-term strategy
Finally, the region wanted to build a long-term cyber defense strategy with clearly defined roles and processes, rather than just dealing with individual incidents in isolation.
Solution
Both the technical layer and the human factor
01
Audit and penetration testing
To put security to a real test, we deployed the Pentera platform, which enables automated yet realistic penetration testing. We examined the authority’s network infrastructure, endpoints, and selected applications. The audit produced a risk map with specific remediation steps, prioritized by impact and difficulty of implementation, so that the authority’s leadership would know where to focus its limited resources first.
02
Strategy and NIS2 readiness
Together with the authority’s leadership, we developed a cyber defense strategy covering security policies, role definitions (CISO, cybersecurity manager), incident response processes, and a roadmap for deploying the technologies needed to meet NIS2 requirements. The goal was for the region to approach the regulation not as a one-time task but as a sustainable, long-term risk management system.
03
Employee training
Technical measures are only half the battle. That is why our Cyber Security Center ran training sessions for the authority’s employees, focused on security basics, phishing recognition, and good data hygiene. The sessions also included hands-on exercises in the form of phishing simulations, which showed employees what attacks look like in real life, not just in theory.
04
Handover and ongoing support
After handing over the strategy, we have remained the region’s long-term partner. The region consults us when rolling out individual measures as well as in crisis situations.
Is your organization
ready for NIS2?
The Moravian-Silesian Region today
Results of the partnership
Thanks to the combination of a technical audit, strategy, and training, the Moravian-Silesian Region now has a clear view of its risks and is ready for the regulatory requirements of NIS2.
What the partnership delivered
The Moravian-Silesian Region is prepared to meet its obligations under NIS2.
A large number of employees trained across the authority.
The technologies behind the project
The project relied on the Pentera platform for penetration testing, an EDR solution such as Microsoft Defender, and a security awareness training platform for employees.
Moravian-Silesian Region
Regional Authority and publicly funded organizations
Penetration testing
Automated yet realistic testing
Endpoint protection
EDR solution such as Microsoft Defender
Employee training
Security awareness training platform
Documentation framework
Security management standard and regulation
XEVOS is a certified partner of the vendors listed.
The entire approach is built on a documentation framework that combines ISO 27001 with NIS2 requirements.
Contact
Preparing for NIS2?
XEVOS Solutions s.r.o.
Get in touch, and together we’ll review where your organization stands on security. Based in Ostrava, serving clients across the Czech Republic.
Phone