Cyberprotech

Govern · Implement · Operate · Respond

A solution is not an isolated product. It is a capability that works as part of a whole.

We organize knowledge, governance, technology and operations into a coherent pathway — adapted to risk, maturity and the outcome the organization needs.

  • Understand the context before proposing
  • Combine capabilities without creating unnecessary dependencies
  • Connect decisions, implementation, operations and evidence
  • Evolve in a modular way, proportionate to risk

Solutions guide

Start with the problem and discover the solution.

In three steps, organize the needs you recognize and obtain an indicative starting point. The recommendation does not replace an assessment of your context.

  1. 1Needs
  2. 2Situation
  3. 3Guidance
Step 1 of 3

What do you need to resolve?

Select one or more situations you recognize.

Cyberprotech ecosystem

An integrated architecture, not a collection of services.

Each capability can address a specific need. The greatest value emerges when governance, implementation, operations and response work from the same context, priorities and coherent evidence.

01

Govern and demonstrate

Turn obligations, risk and accountability into supported decisions and verifiable evidence.

Direction, accountability and compliance
03

Operate and sustain

Keep infrastructure, networks, users and critical services supported, up to date and recoverable.

Continuity and operational capability
04

Monitor and respond

Detect relevant signals, reduce noise, coordinate the response and incorporate lessons learned.

Visibility, response and continuous improvement

Adoption pathways

Start with the organization's context.

The combinations below are guidance points, not rigid packages. The final scope depends on the applicable framework, risk, maturity and internal capability.

01

Public bodies and local authorities

Clarify responsibilities, prepare MyCiber, maintain evidence and ensure continuous support.

MyCiber Assessment + CISOaaS + PCPaaS + CyberComply™Explore the pathway →02

SMEs and growing organizations

Reduce technology fragmentation and improve protection, support, continuity and data governance.

CSaaS + TaaS + DPOaaS + NOCaaSExplore the pathway →03

Regulated, essential or critical entities

Connect oversight, risk management, monitoring, response and implementation evidence.

CISOaaS + SOC/CSIRT + NOCaaS + CyberComply™Explore the pathway →

Integrated capability

Choose by the outcome you need to achieve.

Each page first explains the context, approach and expected outcomes. The decision follows understanding.

Integrated external platform

CyberComply™

A platform for organising continuous compliance, documentation, evidence, responsibilities and roadmaps.

Explore the solution →
Starting point

MyCiber Assessment

A structured review of scope, preparedness, gaps, priorities and next steps in the MyCiber pathway.

Explore the solution →
Governance and accountability

CISOaaS

Compare vCISO and CISOaaS: a vCISO is the external professional of reference; CISOaaS is the continuous service that may combine that professional, a team, a method and continuity.

Explore the solution →
Permanent contact and coordination

PCPaaS

PCPaaS supports the reception, triage, escalation and coordination of cybersecurity alerts, notifications and incidents.

Explore the solution →
Security operations

SOC

SOC service in Portugal for risk-led monitoring, detection, analysis and escalation, with less noise and better signal quality.

Explore the solution →
Incident response

CSIRT

CSIRT support in Portugal for triage, containment, recovery, evidence preservation and preparation of official incident notifications.

Explore the solution →

Learning platform

Cyberprotech Academy

A learning platform for digital pathways, content, sessions and capability-building support.

  • Digital learning pathways
  • Content and sessions
  • Capability-building support
Explore the Academy ↗ Explore the solution → Request information or schedule a session Independent platform at academia.cyberprotech.pt

Specialized capabilities

The outcome first. The acronym second.

These terms identify professional roles or delivery models that can be integrated into a broader solution. They do not require a closed package.

CSaaS

Continuously support the security posture

Cybersecurity as a Service

View context →DPOaaS

Support data protection and the DPO function

Data Protection Officer as a Service

View context →TaaS

Implement and maintain the required technology

Technology as a Service

View context →vCISO

Integrate executive cybersecurity leadership

Virtual Chief Information Security Officer

View context →NOCaaS

Monitor networks, systems and availability

Network Operations Center as a Service

View context →SOCaaS

Detect and analyze security events

Security Operations Center as a Service

View context →

Technical implementation

Technology implemented for the context, not from a catalog.

Implementation begins with the service that must work, the risks that must be reduced and the capability the organization can operate. The technologies below can be addressed independently or together, without artificial commercial dependencies.

Microsoft 365

Identities, devices, collaboration and data under control.

Accumulated settings, excessive privileges, unmanaged devices and inconsistent rules make Microsoft 365 difficult to govern and demonstrate.

Intervention

  • Review of Entra ID, MFA, Conditional Access and privileged roles
  • Configuration of Intune, device compliance and protection policies
  • Defender, Exchange Online, SharePoint, Teams and information protection
  • Logs, alerts, retention, backup and operating procedures

Deliverables

  • Configuration baseline and prioritized deviations
  • Hardening plan and phased implementation
  • Identity, device and responsibility matrix
  • Evidence of configuration, tests and decisions
Boundaries and conditions

Scope depends on existing licenses, architecture, integrations and responsibilities. Changes affecting users are tested and approved before broad deployment.

Assess the Microsoft 365 context →
Infrastructure, networks and endpoints

Verifiable availability, segmentation, updating and recovery.

Servers, networks, storage and endpoints can operate every day without dependencies, vulnerabilities, recovery capability or responsibilities being genuinely controlled.

Intervention

  • Technical inventory and dependency map
  • Network architecture, segmentation, Wi-Fi and remote access
  • Servers, virtualization, storage, backups and recovery
  • Endpoints, secure configuration, patches, vulnerabilities and monitoring

Deliverables

  • Map of assets, services and critical interconnections
  • Technical baseline and prioritized remediation plan
  • Operating, updating and recovery procedures
  • Test records, monitoring and technical evidence
Boundaries and conditions

The engagement may be a project, co-managed arrangement or continuous operation. Manufacturers, warranties, maintenance windows and legacy systems affect what can be changed and in which sequence.

Review technology capability →
OT environments

Intervene without confusing technology security with process safety.

In OT, a technically correct change can affect availability, production or physical safety. The operational context takes precedence over the automatic application of IT measures.

Intervention

  • Define boundaries between IT, OT, process and responsibilities
  • Passive inventory, flows, zones, conduits and third-party access
  • Compatible segmentation, remote access, monitoring and continuity
  • Testing, containment and recovery coordinated with operations and manufacturers

Deliverables

  • IT/OT map and process dependencies
  • Risk, access and interconnection matrix
  • Phased plan with windows, validation and rollback
  • Procedures and evidence agreed with operational owners
Boundaries and conditions

Cyberprotech addresses OT where there is a relevant industrial or operational process or physical infrastructure. We do not perform intrusive changes without authorization, process knowledge, a safe window and the involvement of applicable owners and manufacturers.

Define an OT context →

Evidence and trust

Deliverables that help people decide, execute and demonstrate.

We do not display real client documentation. The examples below are illustrative and anonymised, but reflect the structure and purpose of outcomes that may be produced within an agreed scope.

Document

Approved, structured content defining context, guidance, a plan or a procedure.

Record

Information maintained over time to preserve status, decisions, owners and changes.

Implemented measure

An applied organizational or technical change with a verifiable scope and outcome.

Validated evidence

Reviewed proof supporting a claim about execution, operation or compliance.

DocumentIllustrative representation

Scope assessment report

Consolidate scope, assumptions, uncertainties and next steps for decision-making.

Scope assessedDeclared assumptionsDecisions pending
Owner
Management and process owner
Validation
Technical review and confirmation of assumptions by the organization
Update
When scope, activity or qualification changes
DocumentIllustrative representation

Implementation roadmap

Sequence actions, dependencies, owners, acceptance criteria and deadlines.

Priority and dependencyOwner and deadlineAcceptance criterion
Owner
Program sponsor and coordination
Validation
Approval of priorities and delivery capability
Update
At each program review or material change
RecordIllustrative representation

Risk and decision register

Connect scenarios, impact, treatment, acceptance, owners and decisions.

Risk and contextTreatment decidedStatus and owner
Owner
Risk owners and management
Validation
Review by decision-makers and decision traceability
Update
Periodically and whenever risk or treatment changes
RecordIllustrative representation

Responsibility matrix

Make explicit who decides, executes, validates, is consulted and is informed.

Critical activityOwner and alternateEscalation
Owner
Management and functional owners
Validation
Confirmation of roles and authority by the teams involved
Update
After changes to structure, people, suppliers or process
Implemented measureIllustrative representation

Secure configuration baseline

Apply approved settings to identities, devices, systems or networks.

Configuration appliedScope and exceptionsPost-change test
Owner
Technical system owner
Validation
Technical comparison, testing and approval of the change
Update
With new versions, risks, architecture or requirements
Implemented measureIllustrative representation

Exercised response procedure

Turn responsibilities and contacts into an executable incident workflow.

Activation testedDecisions and timingsImprovements assigned
Owner
Incident coordination and participating teams
Validation
Exercise, observation of timings and remediation of gaps
Update
After an exercise, incident or team change
Validated evidenceIllustrative representation

Recovery test

Demonstrate that data or services can be recovered under defined conditions.

Date and scopeObserved resultValidation and exceptions
Owner
Operations, continuity and service owner
Validation
Observed result, confirmed integrity and recorded exceptions
Update
According to criticality and after relevant changes
Validated evidenceIllustrative representation

Control dossier

Connect requirement, measure, document, record and reviewed proof.

Associated requirementEvidence and versionValidator and date
Owner
Control owner and oversight function
Validation
Review of currency, integrity, authorship and correspondence to the requirement
Update
Within the control cycle and before an assessment or audit

The existence of a file does not, by itself, prove that a measure works. Validation connects what was defined, what was executed and what can be demonstrated.

Explore the Implementation Center

Use cases

Seeing the pathway helps explain the value of the engagement.

These scenarios are illustrative compositions based on recurring needs. They do not identify clients, reproduce real projects or constitute a promise of results.

  1. 01Context
  2. 02Problem
  3. 03Risk
  4. 04Intervention
  5. 05Expected outcome
  6. 06Evidence
01
Illustrative scenario · Local public administration

Municipal company or entity with its own operational services

Context

An organization with its own governance, administrative systems, field operations, technology suppliers and dependencies on a municipality or shared services.

Problem

Responsibilities, assets, access and evidence are distributed across teams and providers, without a single view of the critical service.

Risk

Fragmented decisions, unidentified dependencies, uncertain recovery and difficulty demonstrating who controls each measure.

Intervention

Define scope and dependencies; organize governance, risk and owners; prioritize measures; test recovery; connect execution to documents and evidence.

Expected outcome

Explicit responsibilities, an executable roadmap and greater visibility over services, third parties, continuity and evidence.

Evidence

Dependency map, RACI matrix, risk register, prioritized plan, tests and control dossier.

02
Illustrative scenario · Governance

Organization without an internal CISO

Context

An entity with a technical team and several suppliers, but no permanent role translating technology risk for management.

Problem

Decisions arise around incidents, audits or renewals, without a common cadence, justified priorities or cross-functional oversight.

Risk

Fragmented investment, gaps between suppliers, risks accepted without an explicit decision and inconsistent executive reporting.

Intervention

Define the governance model; integrate a vCISO through CISOaaS; create risk and decision registers; establish meetings, reporting and roadmap oversight.

Expected outcome

Continuous direction, traceable decisions and better coordination between management, operations and providers.

Evidence

Mandate and boundaries, responsibility matrix, decision register, indicators, review minutes and roadmap evolution.

03
Illustrative scenario · MyCiber

Prepare information before self-identification

Context

An organization that must assess its possible scope and gather data on activity, sector, size, services and organizational relationships.

Problem

Information exists in different areas and some answers depend on legal, financial, technical or institutional confirmation.

Risk

Submitting incomplete data, treating assumptions as facts or starting measures without understanding the resulting scope.

Intervention

Structure questions and sources; identify uncertainties; prepare a scope matrix; review data; document assumptions and decisions before submission by the entity.

Expected outcome

A better-informed process, with organized elements, visible uncertainties and proportionate next steps.

Evidence

Scope assessment report, scope matrix, source list, validation record and confirmations issued by the platform.

04
Illustrative scenario · Incident

Coordinate response across management, IT and suppliers

Context

An entity facing unavailability, compromise or a relevant suspicion involving internal systems, providers and continuity decisions.

Problem

Pressure to act quickly can lead to parallel actions, loss of information, late contacts and undocumented decisions.

Risk

Increased impact, destruction of evidence, inconsistent communication, missed deadlines and unvalidated recovery.

Intervention

Activate coordination; preserve facts and evidence; set priorities; coordinate teams and third parties; support assessment, containment, recovery and applicable communications.

Expected outcome

A more controlled response, time-stamped decisions and recovery supported by explicit criteria.

Evidence

Timeline, decision register, chain of custody where applicable, communications, recovery tests and post-incident report.

Any future real case requires written authorization, factual validation by the entity, confidentiality and data-protection review, a defined time period and approval of the final version before publication.

Verifiable indicators

We publish only figures we can explain and reproduce.

These indicators describe public assets in the Cyberprotech ecosystem. On their own, they do not measure impact, service quality, currently active relationships or client outcomes.

25Organizations presented publicly

Counts only active entries in the public catalog. Presence does not mean a currently active contractual relationship, exclusivity, endorsement or use of every service.

Owner
Institutional management
Update
Quarterly and whenever the catalog changes
11Current Newsroom publications

Counts only articles published in the current editorial collection; the historical archive is maintained separately and is not included.

Owner
Editorial owner
Update
Automatically updated with each publication or status change
8Published resources

Counts resources with published status and an associated file. It does not represent downloads, use, effectiveness or satisfaction.

Owner
Editorial and document owner
Update
Automatically updated whenever an item is published, withdrawn or changes status
What is excluded

We do not publish hours, incidents handled, assessments, projects, downloads, success rates or risk reductions without a consolidated source, scope, period, owner, authorization and sufficient context.

Inventory reviewed on 2026-08-28.

Managed and co-managed services

Technology operations that support security, continuity and compliance.

We maintain technical capabilities delivered as outsourcing and organized by operational outcome. We can take on execution, work alongside the internal team or intervene within a specific scope.

01Assess

Technical and security audits

We assess infrastructure, configurations, access, exposure and operating practices to turn findings into executable priorities.

Visibility of gaps and a remediation plan
02Connect

Networks, Wi-Fi and connectivity

We design, implement and manage segmented networks, secure access, connectivity between locations and availability monitoring.

More resilient and controlled communications
03Operate

Servers and infrastructure

We support the installation, migration, administration, updating and monitoring of servers, virtualization, storage and critical services.

Supported and recoverable infrastructure
04Decide

Risk assessment and consultancy

We connect technology risk, business impact, dependencies and investment to support proportionate, defensible decisions.

Priorities connected to the organization's context
05Protect

Managed cybersecurity

We integrate protection, vulnerability management, secure configuration, monitoring and response into a capability adapted to risk.

Continuous control without accumulating isolated tools
06Validate

Technical security testing

We perform vulnerability assessments and security testing with clearly defined scope, authorization, evidence and remediation.

Weaknesses identified before they become incidents
07Preserve

Email archiving and continuity

We structure retention, search, integrity, recovery and email continuity according to operational and legal requirements.

Messages that remain searchable, preserved and recoverable
08Provide

Technology as a Service

We plan and provide hardware, software, licensing and technology lifecycle management with support and operational predictability.

Appropriate technology without fragmented management
09Support

Privacy and data protection

We support data governance, GDPR processes, risk assessment and coordination with the data protection officer function.

Privacy integrated into operations and decision-making
10Resolve

Professional support

We provide remote and on-site support, by appointment or in response to an urgent need, with context, records and follow-up.

A support point for users and operations

The scope may be continuous, temporary or project-based. Before proposing technology, we confirm dependencies, priorities, internal capability and the expected outcome.

Discuss technology operations

Initial guidance

Not sure which solution applies?

We begin with context and priorities, not a predefined proposal.

Identify priorities