{"id":4052,"date":"2026-10-01T10:05:42","date_gmt":"2026-10-01T08:05:42","guid":{"rendered":"https:\/\/www.xevos.eu\/?page_id=4052"},"modified":"2026-10-29T10:49:39","modified_gmt":"2026-10-29T09:49:39","slug":"cyber-resilience-for-the-moravian-silesian-region","status":"publish","type":"page","link":"https:\/\/www.xevos.eu\/en\/cyber-resilience-for-the-moravian-silesian-region\/","title":{"rendered":"Cyber resilience for the Moravian-Silesian Region"},"content":{"rendered":"
[vc_section el_class=”xvs-section xvs-hero xvs-hero–light”][vc_row][vc_column][vc_column_text css=””]\r\n
\r\n
\r\n
\r\n
\r\n

Case study \u00b7 Public sector<\/p>\r\n\r\n

Cyber resilience for the Moravian-Silesian Region<\/h1>\r\n

Audit, penetration testing, and NIS2 readiness.<\/strong> Public administration manages citizens\u2019 sensitive data and provides services that hospitals, schools, and social care facilities rely on to keep running. That is why an attack on a single organization in this ecosystem never stays isolated\u2014it affects thousands of people who depend on that service. With the arrival of the NIS2 Directive, which requires organizations to demonstrably manage cybersecurity and report incidents, the Moravian-Silesian Region needed a realistic and comprehensive picture of its resilience. It brought this challenge to XEVOS.<\/p>\r\n\r\n<\/div>\r\n

I want to assess our security<\/a><\/div>\r\n<\/div>\r\n
\r\n
\r\n
\r\n

4<\/p>\r\n

areas of work, from audit to ongoing support<\/p>\r\n\r\n<\/div>\r\n

\r\n

NIS2<\/p>\r\n

preparation for obligations under the new regulation<\/p>\r\n\r\n<\/div>\r\n

\r\n

ISO 27001<\/p>\r\n

documentation framework alongside NIS2<\/p>\r\n\r\n<\/div>\r\n

\r\n

Pentera<\/p>\r\n

automated yet realistic penetration testing<\/p>\r\n\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”xvs-section xvs-section–cs xvs-cs-klient”][vc_row][vc_column][vc_column_text css=””]\r\n

\r\n
\r\n

About the client<\/p>\r\n\r\n

A client responsible for dozens of organizations<\/h2>\r\n

The Moravian-Silesian Region is one of the largest regional governments in the Czech Republic. The Regional Authority oversees dozens of publicly funded organizations, including schools, hospitals, and social care facilities.<\/p>\r\n

This means that a security incident at any one of them affects not only the authority itself but, above all, the services these organizations provide to citizens. On top of that, with the arrival of NIS2, what used to be \u201cgood practice\u201d is becoming a legal obligation.<\/p>\r\n\r\n<\/div>\r\n

\r\n

Client profile<\/p>\r\n\r\n

\r\n
\r\n

Industry<\/p>\r\n

Public sector, regional government<\/p>\r\n\r\n<\/div>\r\n

\r\n

Presence<\/p>\r\n

Moravian-Silesian Region, dozens of publicly funded organizations<\/p>\r\n\r\n<\/div>\r\n

\r\n

What it does<\/p>\r\n

Regional Authority overseeing schools, hospitals, and social care facilities<\/p>\r\n\r\n<\/div>\r\n

\r\n

Partnership with XEVOS<\/p>\r\n

Audit, penetration testing, NIS2 strategy, and employee training<\/p>\r\n\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”xvs-section xvs-section–cs xvs-cs-vyzva”][vc_row][vc_column][vc_column_text css=””]\r\n

\r\n
\r\n

Challenge<\/p>\r\n\r\n

From paper to practice<\/h2>\r\n

The region approached XEVOS with four interrelated requirements.<\/p>\r\n\r\n<\/div>\r\n

\r\n
\r\n

Real-world verification<\/p>\r\n

Above all, it needed a realistic picture of its current level of security\u2014not just on paper (in documentation and policies) but verified in practice through penetration testing.<\/p>\r\n\r\n<\/div>\r\n

\r\n

NIS2 readiness<\/p>\r\n

At the same time, it had to prepare for the obligations arising from NIS2 and the new Czech Cybersecurity Act, which apply directly to regional governments.<\/p>\r\n\r\n<\/div>\r\n

\r\n

The human factor<\/p>\r\n

The third area was raising employees\u2019 awareness of phishing, social engineering, and good security hygiene when handling sensitive data. After all, the human factor plays a key role in public-sector security.<\/p>\r\n\r\n<\/div>\r\n

\r\n

Long-term strategy<\/p>\r\n

Finally, the region wanted to build a long-term cyber defense strategy with clearly defined roles and processes, rather than just dealing with individual incidents in isolation.<\/p>\r\n\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”xvs-section xvs-section–cs xvs-jak-pracujeme xvs-cs-reseni”][vc_row][vc_column][vc_column_text css=””]\r\n

\r\n
\r\n

Solution<\/p>\r\n\r\n

Both the technical layer and the human factor<\/h2>\r\n<\/div>\r\n
\r\n
\r\n

01<\/p>\r\n

Audit and penetration testing<\/p>\r\n

To put security to a real test, we deployed the Pentera platform, which enables automated yet realistic penetration testing. We examined the authority\u2019s network infrastructure, endpoints, and selected applications. The audit produced a risk map with specific remediation steps, prioritized by impact and difficulty of implementation, so that the authority\u2019s leadership would know where to focus its limited resources first.<\/p>\r\n\r\n<\/div>\r\n

\r\n

02<\/p>\r\n

Strategy and NIS2 readiness<\/p>\r\n

Together with the authority\u2019s leadership, we developed a cyber defense strategy covering security policies, role definitions (CISO, cybersecurity manager), incident response processes, and a roadmap for deploying the technologies needed to meet NIS2 requirements. The goal was for the region to approach the regulation not as a one-time task but as a sustainable, long-term risk management system.<\/p>\r\n\r\n<\/div>\r\n

\r\n

03<\/p>\r\n

Employee training<\/p>\r\n

Technical measures are only half the battle. That is why our Cyber Security Center ran training sessions for the authority\u2019s employees, focused on security basics, phishing recognition, and good data hygiene. The sessions also included hands-on exercises in the form of phishing simulations, which showed employees what attacks look like in real life, not just in theory.<\/p>\r\n\r\n<\/div>\r\n

\r\n

04<\/p>\r\n

Handover and ongoing support<\/p>\r\n

After handing over the strategy, we have remained the region\u2019s long-term partner. The region consults us when rolling out individual measures as well as in crisis situations.<\/p>\r\n\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”pentest-cta xvs-cs-cta”][vc_row][vc_column][vc_column_text css=””]\r\n

\r\n
\r\n
\r\n

Is your organization\r\nready for NIS2?<\/h2>\r\n
I want to assess our security<\/a><\/div>\r\n
<\/div>\r\n
\"\" \"\" \"\"<\/div>\r\n
\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n<\/div>\r\n
\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n<\/div>\r\n
<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”xvs-section xvs-section–cs xvs-cs-vysledky”][vc_row][vc_column][vc_column_text css=””]\r\n
\r\n
\r\n

The Moravian-Silesian Region today<\/p>\r\n\r\n

Results of the partnership<\/h2>\r\n

Thanks to the combination of a technical audit, strategy, and training, the Moravian-Silesian Region now has a clear view of its risks and is ready for the regulatory requirements of NIS2.<\/p>\r\n\r\n<\/div>\r\n

\r\n

What the partnership delivered<\/p>\r\n\r\n

\r\n

The Moravian-Silesian Region is prepared to meet its obligations under NIS2.<\/p>\r\n\r\n<\/div>\r\n

\r\n

A large number of employees trained across the authority.<\/p>\r\n\r\n<\/div>\r\n<\/div>\r\n

I want a similar audit<\/a><\/div>\r\n<\/div>\r\n[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”xvs-section xvs-section–cs xvs-cs-technologie”][vc_row][vc_column][vc_column_text css=””]\r\n
\r\n
\r\n

The technologies behind the project<\/h2>\r\n

The project relied on the Pentera platform for penetration testing, an EDR solution such as Microsoft Defender, and a security awareness training platform for employees.<\/p>\r\n\r\n<\/div>\r\n

\r\n
\r\n

Moravian-Silesian Region<\/p>\r\n

Regional Authority and publicly funded organizations<\/p>\r\n\r\n<\/div>\r\n

\r\n

Penetration testing<\/p>\r\n

Automated yet realistic testing<\/p>\r\n\r\n

\r\n
\"Pentera\"<\/div>\r\n<\/div>\r\n<\/div>\r\n
\r\n

Endpoint protection<\/p>\r\n

EDR solution such as Microsoft Defender<\/p>\r\n\r\n

\r\n
\"Microsoft<\/div>\r\n<\/div>\r\n<\/div>\r\n
\r\n

Employee training<\/p>\r\n

Security awareness training platform<\/p>\r\n\r\n

\r\n
Phishing simulations<\/div>\r\n<\/div>\r\n<\/div>\r\n
\r\n

Documentation framework<\/p>\r\n

Security management standard and regulation<\/p>\r\n\r\n

\r\n
ISO 27001<\/div>\r\n
NIS2<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n

XEVOS is a certified partner of the vendors listed.<\/p>\r\n

The entire approach is built on a documentation framework that combines ISO 27001 with NIS2 requirements.<\/p>\r\n\r\n<\/div>\r\n[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_id=”contact” el_class=”xvs-section xvs-cs-kontakt”][vc_row][vc_column][vc_column_text css=””]\r\n

\r\n
\r\n

Contact<\/p>\r\n\r\n

Preparing for NIS2?<\/h2>\r\n\n
\n

<\/p>

    <\/ul><\/div>\n
    \n
    \n<\/fieldset>\n
    \n
    \n <\/span>\n <\/div>\n
    \n <\/span>\n <\/div>\n
    \n <\/span>\n <\/div>\n
    \n