IMA: NIS2 Compliance & GRC

Introduction

Establishing an effective cybersecurity governance framework requires an understanding of an organization's current security posture, the implementation of appropriate policies and procedures, and structured management of compliance-related information.

Whirr Crew collaborated with IMA on a comprehensive cybersecurity and GRC initiative combining compliance assessment, organizational framework development, and implementation of the AuditMaster platform. The engagement brought together consulting and technology-enabled governance activities to support the management of cybersecurity requirements.

Challenges

The project addressed three interconnected areas of cybersecurity governance. First, the organization's existing cybersecurity processes, technical measures, and documentation needed to be evaluated against NIS2 and Czech Cybersecurity Act requirements. Second, organizational policies and procedures needed to be developed to address the relevant compliance requirements. Finally, governance information, including assets, suppliers, risks, and security controls, needed to be structured within a dedicated GRC platform to support ongoing compliance management.

Solution

Whirr Crew delivered three interconnected project workstreams.

1. NIS2 Gap Assessment

The initial assessment reviewed the organization's cybersecurity governance, existing security processes, technical measures, and documentation against the requirements of NIS2 and ZoKB. The assessment identified compliance gaps and provided recommendations for addressing the identified areas.

2. NIS2 Compliance Framework Implementation

Whirr Crew developed the organizational, procedural, and documentation framework required to support NIS2 compliance. The scope covered cybersecurity policies and procedures addressing asset management, risk management, access control, incident management, supplier security, business continuity, backup and recovery, vulnerability management, and other relevant security domains.

3. AuditMaster GRC Platform Implementation & Data Onboarding

The third workstream involved the end-to-end implementation and operationalization of the AuditMaster GRC platform.

The activities included:

• Configuration of the governance structure within AuditMaster.

• Migration and population of asset and vendor information.

• Execution of Business Impact Analysis (BIA).

• Cybersecurity risk assessments.

• Supplier risk evaluation.

• Establishment of a controls management system.

The platform implementation brought these activities into a structured environment designed to support ongoing governance, risk, and compliance management.

Results

The engagement produced several interconnected deliverables. The gap assessment identified areas requiring compliance attention and established recommendations for remediation. The compliance implementation workstream developed the policies, procedures, and organizational documentation supporting NIS2/ZoKB requirements.

The AuditMaster implementation established a GRC platform environment incorporating organizational governance structures, asset and supplier information, business impact and risk assessments, and controls management. Together, these deliverables provided IMA with a structured foundation for managing cybersecurity governance, risks, and compliance-related activities.

Conclusion

The IMA project demonstrates Whirr Crew's ability to deliver integrated cybersecurity and GRC services, combining regulatory assessment, organizational framework development, and implementation of a dedicated governance platform.

The engagement highlights the connection between cybersecurity consulting and practical GRC operationalization, extending beyond documentation into structured management of risks, assets, suppliers, and controls.