LAGARDÈRE TRAVEL RETAIL: Cybersecurity, Audits & GRC

Introduction

Lagardère Travel Retail is an international travel retail operator with a business environment supported by information systems, technology infrastructure, and organizational security processes.

Managing cybersecurity across such an environment involves multiple dimensions, including regulatory requirements, protection of critical systems, resilience of backup and recovery capabilities, and the effective management of security risks and controls.

Whirr Crew collaborated with Lagardère Travel Retail across four cybersecurity initiatives addressing these areas through compliance consulting, technical security auditing, remediation activities, and GRC platform implementation.

Challenges

The engagement covered several interconnected cybersecurity governance and operational security requirements. An organizational and documentation framework was needed to support alignment with NIS2 and Czech Cybersecurity Act requirements. The security and resilience of the organization's hybrid backup and recovery infrastructure also required a comprehensive assessment against relevant security standards and internal policies.

In addition, cybersecurity audit findings required coordinated remediation activities, including corrective-action planning, implementation, evidence collection, and tracking. Another area of work involved establishing structured management of governance information, risk assessments, suppliers, and security controls through a dedicated GRC platform.

Together, these initiatives addressed both organizational cybersecurity governance and practical security operations.

Solution

Whirr Crew contributed to four distinct but complementary cybersecurity workstreams.

1. NIS2 Compliance Framework Implementation

Whirr Crew developed an organizational, procedural, and documentation framework supporting compliance with NIS2 and the Czech Cybersecurity Act.

The scope covered security policies and procedures related to:

• Asset and risk management.

• Access control and identity-related security governance.

• Incident management.

• Supplier security.

• Business continuity.

• Backup and recovery.

• Vulnerability management.

• Additional organizational cybersecurity requirements.

The framework established documented governance practices across the relevant cybersecurity domains.

2. Comprehensive Backup Security & Resilience Audit

Whirr Crew conducted a comprehensive security and compliance audit of the organization's hybrid backup and recovery environment. The assessment covered Microsoft Azure, Commvault, and Veeam technologies, reviewing backup architecture, system configuration, operational effectiveness, and the protection of backup data.

The audit evaluated several important security and resilience areas.

Backup Architecture and Configuration
Review of the backup environment's architecture, configuration, and operational arrangements.

Ransomware Resilience and Data Protection
Assessment of backup isolation, encryption, immutability, and controls intended to protect backup data from unauthorized modification or compromise.

Access Controls and Monitoring
Evaluation of access security, monitoring capabilities, and integration with security information and event management (SIEM) processes.

Recovery Capabilities and Business Continuity
Review of restoration testing and the alignment of Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) with Business Impact Analysis and continuity requirements.

External Service Provider Dependencies
Assessment of dependencies on external service providers within the backup and recovery environment.

The audit was conducted against relevant ISO/IEC 27001 and ISO/IEC 27002 requirements and the organization's internal Group Backup Policy.

3. Cybersecurity Audit Findings Remediation

Whirr Crew managed and implemented a multi-workstream remediation program addressing cybersecurity audit findings. The scope included the development and coordination of corrective-action plans, implementation of technical and organizational security measures, and tracking of remediation progress. Additional activities involved coordinating relevant stakeholders, collecting supporting evidence, and preparing formal audit closure documentation.

This workstream focused on translating identified audit findings into documented corrective actions and their implementation.

4. AuditMaster GRC Platform Implementation & Data Onboarding

Whirr Crew implemented and operationalized the AuditMaster GRC platform to support structured governance, risk, and compliance management.

The implementation included:

• Configuration of the organizational governance structure.

• Migration and population of asset and vendor information.

• Execution of Business Impact Analysis.

• Cybersecurity risk assessments.

• Supplier risk evaluation.

• Establishment of a controls management system.

The platform implementation was designed to support ongoing NIS2/ZoKB and ISO 27001-related compliance management through a structured GRC environment.

Results

The collaboration produced deliverables across four complementary areas of cybersecurity.

Regulatory Compliance Governance
Development of a structured NIS2/ZoKB-related organizational and documentation framework covering essential cybersecurity management domains.

Backup Security Assessment
Completion of a comprehensive audit addressing the security, configuration, resilience, and recovery capabilities of the hybrid backup environment.

Audit Remediation
Management and implementation of corrective-action activities, including remediation tracking, evidence collection, stakeholder coordination, and preparation of audit closure documentation.

GRC Platform Operationalization
Implementation of AuditMaster with structured governance data, asset and supplier information, risk assessment activities, and controls management capabilities.

Together, these workstreams established and supported multiple components of the organization's cybersecurity governance and security management activities.

Conclusion

The Lagardère Travel Retail engagement demonstrates Whirr Crew's ability to support complex cybersecurity initiatives combining regulatory compliance, technical security auditing, remediation management, and GRC implementation.

By addressing organizational documentation, technical infrastructure, corrective actions, and governance tooling, Whirr Crew contributed expertise across several interconnected dimensions of enterprise cybersecurity management.