Situation
An energy company in Kaunas, Lithuania, with 200 employees, operates heat generation and distribution infrastructure for part of the city. Its IT estate is mixed: office systems, Microsoft 365 and accounting, and on a separate network the production control (SCADA) systems maintained by the technology department. The IT department is three people, and the cybersecurity function is assigned to the head of IT alongside daily work.
Under the updated Cybersecurity Act, which transposed the NIS2 directive (TIS2 in Lithuanian law), the company was classed as an essential entity. The national cybersecurity authority asked it to submit a risk assessment, security policies and an incident management procedure. The company had a few old documents written under the previous law, but none that reflected its current infrastructure.
The CEO and the board wanted two things: to know the real situation, and to have a person who is accountable for security continuously, not only when a request arrives.
What was needed
- An independent IT security audit covering the office network and its interfaces with the operational network.
- A risk assessment that the board could understand and the national cybersecurity authority would accept.
- A set of security policies and procedures tailored to the company, not copied from a template.
- Regular vulnerability scanning and a clear process for who fixes the gaps found, and within what time.
- An incident management plan with the deadlines for reporting to the national cybersecurity authority.
- A continuous security leadership function without a new hire.
What we did
Month 1: IT security audit
We carried out an IT security audit: a review of the network architecture, an analysis of access and privileged accounts, external and internal vulnerability scanning, an assessment of the Microsoft 365 configuration, and interviews with the IT and technology departments. The result was 64 findings, 9 of them critical. The most common were shared administrator passwords, remote access to the operational network without multi-factor authentication, network devices that were not being updated, and backups on the same network as the servers.
Month 2: risk assessment and closing critical gaps
We turned the audit findings into a risk assessment based on impact on the company’s operations: what would happen to heat supply, accounting and customer service. The board approved the risk appetite and a priority list. In parallel the IT department, with our help, closed the critical gaps: multi-factor authentication was introduced for all remote access, administrative accounts were separated, network equipment was updated, and backups were moved to immutable storage.
The hardest part was the operational network. Some SCADA components run on old operating systems that cannot be updated without the manufacturer. Instead of updating them we applied compensating measures: strict network segmentation, access only through a controlled jump server with session recording, and separate monitoring. We agreed these solutions with the technology department so that security would not get in the way of production processes.
Month 3: policies and incident plan
We wrote 12 policies and procedures: information security policy, access management, supplier security, change management, backup and recovery procedure, incident management and others. Each is no longer than a few pages and names a specific responsible person. The incident plan describes classification, the deadlines for reporting to the national cybersecurity authority, communication with the municipality and customers, and the actions to take if the operational network is affected. We tested the plan with a tabletop exercise with management.
Month 4: vCISO and a regular cycle
From the fourth month we began the CISO service: our certified specialist (CISM, CRISC) works one day a week as the company’s security leader. We introduced monthly vulnerability scanning with remediation deadlines by severity, a quarterly report to the board and an annual update of the risk assessment.
Result
All 9 critical audit findings were closed by the end of the third month; the number of open critical vulnerabilities is now zero, confirmed by every month’s scan. The company has 12 approved policies and procedures, a risk register and an incident plan, a package that was submitted to the national cybersecurity authority and received no comments.
Every quarter the board receives a one-page report: the change in risks, open vulnerabilities by severity, incidents and the status of audit actions. It is the first time security has been discussed at board level as a standing item rather than as a reaction to a letter. The monthly scan results show the trend: over half a year the number of medium-severity vulnerabilities fell by about a third, and newly found gaps are closed within the agreed deadline.
“The audit showed what we suspected. Most important, there is now a person who checks every month that the gaps have not opened again.”
What we would advise in a similar situation
- Start with an audit, not with policies. A policy written without knowing the real situation will be impossible to implement.
- Do not leave the operational network out of scope. The interfaces between the office and production networks are most often the weakest point.
- Present risks to the board in business language: hours without supply, fines, reputation. That unlocks budget faster than a list of technical vulnerabilities.
- Security is a cycle, not a project. A monthly scan and a quarterly report matter more than the thickest document.
