What are your security vulnerabilities? Physical and cyber protection audits

Many organizations deal with individual security measures: camera systems, access cards or internal rules. However, individual measures do not yet constitute a functional security system. Security audit will check that technical security, staff readiness and crisis procedures work together. He's not just looking for trouble. It gives the management an overview of risks, priorities and concrete steps. At GBH Academy, we conduct both physical and cyber security audits. Both will show how prepared your organization is for crisis situations.

Physical security audit

The audit focuses on soft targets, i.e. objects where a lot of people move and where protection is weak. These include schools, offices, hospitals, large companies, social services, cultural and sports facilities. In recent years, attacks in the Czech Republic have shown how vulnerable these objects are: shootings at the Faculty of Arts of Charles University and at an office in Chřibská.

There is no comprehensive legal obligation to introduce specific security measures yet. But there are more and more recommended standards that determine what level of security is expected from organizations. The management of companies and institutions therefore not only deals with the protection of people, but also with their own responsibility and preparedness for threats.

What will the audit bring?

A physical security audit is an independent assessment of how prepared a facility is for a serious violent attack. We will not only find weak points, but we will propose specific measures for each one. Instead of general recommendations, you will receive a plan with priorities, a schedule and a cost estimate.

The audit answers questions that management often only asks in a crisis situation. How prepared is the facility for a serious attack? Where can you get into the building and how is the entry of people managed? How would the staff handle the first few minutes before the police arrived? How much will the measures cost and how will they be spread over time? The director, mayor, company management and operations manager can work with the final report.

What are the stages of an audit?

The assessment has several subsequent steps. First, we analyze the object and its surroundings, possible sources of threats and methods of attack. Then we will physically inspect the facility: the mode of entry of people, internal spaces, readiness for internal evacuation and technologies such as cameras and electronic security systems.

The human factor has the same weight. We assess how the employees are trained, whether there are crisis plans, how the warning works and how cooperation with the components of the integrated rescue system is set up. The output is a safety plan with recommended steps, schedule and procedures for emergency situations.

The audit can be followed by practice of model situations. In the Active Attacker training, staff practice in a controlled environment how to respond in a crisis and verify that the procedures are working. A team that has rehearsed the procedure then reacts more quickly and in a more coordinated manner even in a real situation.

The audit is carried out by experts from practice

The analysis is processed by Lumír Němec, Security Director of the GBH Group. He served for over ten years with URNA, then commanded the Special Operations Unit (SOG) of the Military Police and completed missions in Iraq, Kosovo and Afghanistan. Other members of the team are former members of the Army and Police of the Czech Republic with experience in protecting people and objects, solving crisis situations and responding to security incidents.

The assessment is based on the methodology of the Ministry of the Interior of the Czech Republic, the standard ČSN 73 4400 and procedures verified in practice. The recommendation is therefore based on experience from an environment where speed and whether the measures actually work determine the outcome.

Cyber Security Audit

Cyber security doesn't just belong to the IT department. It is part of the management of the entire organization, because data, access, e-mail and cloud systems rely on daily operations. What happens if access data is leaked, someone hacks your email or encrypts data you can't work without? And do you have procedures according to which the team acts without improvisation in such a situation?

Most cyber incidents are not caused by technology failures. The cause is usually poorly set processes, weak points in approaches or human error. Antivirus and basic IT security are therefore not enough. An organization needs to know how well its systems, data and people are protected.

How is an audit useful?

Cyber Audit GBH Academy examine how the organization handles data, approaches, systems and suppliers and how it is prepared for current cyber threats. The result is an overview of risks and specific recommendations.

The audit will also determine how the new cybersecurity law applies to the organization. The Act sets out obligations for providers of regulated services and introduces two levels of security requirements. For many organizations, audit is therefore also a matter of compliance with the law. It is also often required by insurance companies when arranging cyber insurance or public procurement providers.

What does an audit consist of?

The analysis has three steps. First, we determine the level of regulation the organization falls into and what it must comply with. We then compare the desired state with the actual operation in detail: identity and access management, password management, multi-factor authentication, security of e-mail communication, backup, remote access and handling of sensitive data. We will also check external service providers, who tend to be the weakest link in security.

The third step is a plan that translates the identified risks into specific tasks: what to do now, what to do in the following months and what to do in the long term. We will also prepare documents required by legislation, for example safety rules and internal guidelines. You can use them directly or hand them over to the responsible teams.

The audit also deals with who in the organization is responsible for cyber security. These roles must be clearly defined and filled. If you have no one to fill them, experts GBH Academy can take over. Safety is not only on paper, but works in operation.

Who will assess your cyber security?

The audit is conducted by experts from major technology firms and former members of the intelligence services. They have experience in defense against commercial and industrial espionage, eavesdropping and monitoring of electronic communications. They meet the legal requirements for qualifications, experience and independence. Their expertise is evidenced by the certification of the National Office for Cyber ​​and Information Security (NÚKIB) and the accredited certification body TAYLLORCOX. During the audit, they combine the requirements of the law with experience from real security incidents.

Security cannot be solved once and for all. It needs to be regularly verified and adjusted according to current risks. A physical and cyber security audit will show you where your organization stands today, which risks it underestimates and where to start. The GBH Academy team has completed contracts for more than a thousand organizations from various fields and applies the experience from them in every subsequent audit. You can find the entire offer of crisis preparedness on the website GBH Academy. Sledovat nás můžete také na Facebooku, Instagramu a TikToku.