​Voice of the customer

Based on Service Contract no. 1 dated 20.08.2021, concluded between INTERNATIONAL ALEXANDER S.R.L. and S.C. SECTIO AUREA S.R.L., we hereby confirm that Mr. Eduard Mădălin Bratu, acting as expert and representative of S.C. SECTIO AUREA S.R.L., provided specialized audit and consultancy services in the field of cybersecurity, with a focus on assessing the level of compliance with the requirements of the NIS Directive (Network and Information Systems), namely Directive (EU) 2016/1148, transposed into national legislation through Law no. 362/2018.

Within this engagement, Mr. Eduard Mădălin Bratu, through S.C. SECTIO AUREA S.R.L., identified by VAT number RO18334569, registered with the Trade Registry under no. J40/1426/2006, with its registered office in Romania, Bucharest, Calea Vitan Street no. 23C, Vitan Business Center, Room 2, Sector 3, postal code 031281, carried out a structured and documented evaluation of the organization’s level of compliance with the applicable legal requirements in the field of network and information systems security.

The activities performed were based on a methodological approach aligned with best practices in cybersecurity auditing and NIS compliance, primarily focusing on the analysis of the information security governance framework, the evaluation of existing technical and organizational controls, the identification of non-conformities and associated risks, the formulation of clear and well-substantiated findings, and the issuance of practical and actionable recommendations aimed at remediating identified non-conformities and increasing the organization’s cybersecurity maturity level.

Throughout the collaboration, Mr. Eduard Mădălin Bratu demonstrated professionalism, strong technical expertise, and a solid understanding of the requirements of the NIS Directive and Law no. 362/2018, as well as the ability to translate regulatory requirements into clear conclusions and relevant recommendations for the organization’s management, supporting informed decision-making in the field of cybersecurity.

Considering the successful completion of all contractual activities and the quality of the services provided, we confidently recommend Mr. Eduard Mădălin Bratu and S.C. SECTIO AUREA S.R.L. to all organizations wishing to evaluate and improve their level of compliance with the requirements of the NIS and NIS2 Directives, as well as to strengthen their overall cybersecurity posture.

The activities carried out also included the definition and consolidation of information security governance, through the development of the security strategy, the definition and optimization of the governance framework, its integration into the organization’s corporate governance, and the review, adjustment, and optimization of information security policies. In this context, key performance indicators and security indicators were defined, along with the associated reporting framework, to support management in the decision-making process.

In the area of information security risk management, activities included defining and optimizing the process for classifying information assets, conducting risk analyses, vulnerability assessments, and threat analyses, identifying and recommending risk treatment measures, and evaluating the effectiveness of existing security controls. Risk management was integrated into business and IT processes, while internal and external factors that could trigger risk reassessment were continuously monitored. Non-conformities and relevant risk changes were reported in a structured manner to facilitate managerial decision-making.

The information security program management was also addressed by establishing and administering security processes and resources, defining and implementing a structured awareness program, developing and managing security standards, procedures and documentation, and integrating security requirements into IT processes and change management processes. Activities also covered business continuity and disaster recovery (BCP & DRP), the integration of security requirements into third-party relationships, and assistance in collecting, consolidating, and presenting relevant information for management and third parties.

In the field of information security incident management, the activities included defining the incident severity hierarchy, notification and escalation processes, the coordination framework for incident response management, internal and external communication plans, as well as post-incident analysis processes (RCA), corrective actions, and risk reassessment. The incident response plan was also integrated with the business continuity and disaster recovery plans.

Specific activities included the development of a cartographic overview of the IT ecosystem, the definition of network and information systems architectures, security risk analysis, the definition of security performance indicators, establishing security requirements for third parties and incorporating them into contracts, defining the processes and the Vulnerability Management Program, defining the Security Incident Reporting and Management System, providing consultancy in the selection of appropriate technical security measures, as well as updating the Business Continuity Plan, crisis management procedures, and disaster recovery plans.

Throughout the collaboration, Mr. Eduard Mădălin Bratu demonstrated professionalism, strong technical competence, and a solid understanding of the requirements of the NIS Directive and Law no. 362/2018, as well as the ability to translate regulatory requirements into clear conclusions and relevant recommendations for the organization’s management.

Considering the successful completion of all contractual activities and the quality of the services delivered, we confidently recommend Mr. Eduard Mădălin Bratu and S.C. SECTIO AUREA S.R.L. to organizations seeking to evaluate and improve their compliance with the requirements of the NIS and NIS2 Directives and to strengthen their cybersecurity posture and information security governance framework.