EU Critical Entities Resilience Directive

An assessment is only defensible if the findings in it are observed rather than asserted. Discovery supplies what regulated data exists and where, scanning supplies the configuration and exposure posture, and the audit trail supplies who has actually been reaching it — so the assessment describes the estate as measured. Our advisory engagements then map each finding to the specific mandate it touches and sequence the remediation.

A continuity requirement asks two different things, and only one of them is a database control. The recovery plan, the failover drill, and the tested restore are yours. What is produced here is the evidence layer under them: backups and exports are hashed and baselined alongside the datafiles, so a backup that was silently truncated, moved, or never written is evident rather than discovered at the restore. Audit events land in columnar storage on immutable object storage with a verification hash per record, so the history survives the incident that made you need it and is still queryable in seconds afterwards. Collection failure is itself an alerting condition, which is what evidences that the record was continuous rather than merely intended to be.

Notification clocks start when you become aware, so detection latency is the whole exposure. Behavioural baselines score each deviation as it happens and flag it in under a second, rather than surfacing it in a weekly review. Severity is decided at the collector and routed immediately, so the window between the access and someone knowing about it is measured in seconds — and the audit trail behind it already holds what was reached, by whom, and when.

A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.