Question 1

What is CryptaGuard?

Accepted Answer

CryptaGuard is a consulting firm specializing in cybersecurity, business continuity, and organizational resilience. We help businesses implement robust security strategies, business continuity plans (BCP), and crisis management programs.

Question 2

What types of businesses do you work with?

Accepted Answer

We work with organizations of all sizes, from SMBs to large enterprises, across various sectors: finance, healthcare, manufacturing, energy, retail, telecommunications, aviation, and public sector. Our expertise adapts to the specific needs of each industry.

Question 3

In which regions do you operate?

Accepted Answer

We primarily operate in Europe (France, Belgium, Luxembourg, Switzerland) with international intervention capability for large-scale projects. We also offer remote consulting services for worldwide reach.

Question 4

What is a Business Continuity Plan (BCP)?

Accepted Answer

A Business Continuity Plan (BCP) is a set of procedures and measures enabling an organization to maintain or quickly resume its critical activities following a major incident (cyberattack, natural disaster, system failure, etc.). It defines the RTO (Recovery Time Objective) and RPO (Recovery Point Objective) for each critical process.

Question 5

What is the difference between BCP and DRP?

Accepted Answer

The Business Continuity Plan (BCP) covers the entire organization and all business aspects, while the Disaster Recovery Plan (DRP) focuses specifically on restoring IT systems and data. The DRP is generally a subset of the BCP.

Question 6

Do you offer cybersecurity training?

Accepted Answer

Yes, we offer customized training for your teams: cybersecurity awareness, crisis management, incident response, regulatory compliance (ISO 27001, ISO 22301, NIS2, GDPR), as well as simulation exercises (tabletop exercises, continuity tests).

Question 7

How long does it take to implement a BCP?

Accepted Answer

The duration depends on the size and complexity of your organization. On average, expect 3 to 6 months for an SMB, and 6 to 12 months for a large enterprise. This includes business impact analysis (BIA), risk identification, procedure drafting, testing, and staff training.

Question 8

How can I protect my business against ransomware?

Accepted Answer

Effective protection against ransomware requires a multi-layered approach: regular offline backups, network segmentation, EDR/XDR, employee awareness, patch management, multi-factor authentication, incident response plan, and regular testing of your restoration procedures.

Question 9

What is a cyber maturity assessment?

Accepted Answer

A cyber maturity assessment measures your organization's level of preparedness against cyber threats. We analyze your security controls according to recognized frameworks (NIST CSF, ISO 27001, CIS Controls) and produce a report with prioritized recommendations and an improvement roadmap.

Question 10

Do you perform penetration testing (pentest)?

Accepted Answer

We do not directly perform technical penetration tests, but we work in partnership with certified specialized companies. We coordinate these tests as part of our cyber governance missions and analyze the results to define remediation plans.

Question 11

How are your pricing offers structured?

Accepted Answer

Our services can be billed as fixed-price (project), time and materials (daily rate), or as a subscription for ongoing support. We also offer standardized packages for SMBs. Each project is subject to a customized quote after an initial audit.

Question 12

Do you offer a free initial audit?

Accepted Answer

Yes, we offer a free 2-hour initial assessment to understand your needs, identify your priority risks, and propose a tailored roadmap. This session can be conducted on-site or via videoconference.

Question 13

Are there financial incentives for cybersecurity?

Accepted Answer

Yes, several programs exist depending on your country and sector: France Relance, BPI France subsidies, European funds (ERDF), regional grants. We assist you in identifying and preparing funding applications.

Question 14

What are RTO and RPO?

Accepted Answer

RTO (Recovery Time Objective) is the maximum acceptable time to restore a process after an incident. RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time. Example: An RTO of 4h means the service must be restored within 4 hours; an RPO of 1h means a maximum of 1 hour of data can be lost.

Question 15

What is a BIA (Business Impact Analysis)?

Accepted Answer

A BIA is a systematic analysis that identifies and evaluates the potential impacts of an interruption to critical business processes. It helps determine continuity priorities, required RTO/RPO, dependencies, and resources needed for business recovery.

Question 16

How do you test a BCP/DRP?

Accepted Answer

We use several testing methods: tabletop exercises, partial tests of specific components, full crisis simulations, technical restoration tests (failover), and crisis communication exercises. The recommended frequency is at least annual, with quarterly partial tests.

Question 17

What does ISO 27001 compliance mean?

Accepted Answer

ISO 27001 is an international standard that defines requirements for establishing, implementing, maintaining, and improving an Information Security Management System (ISMS). Certification demonstrates that your organization manages information security systematically and in accordance with best practices.

Question 18

What is the NIS2 directive?

Accepted Answer

NIS2 (Network and Information Security Directive 2) is a European directive that imposes cybersecurity requirements on essential and important service operators. It strengthens security, incident notification, and cyber governance obligations for critical sectors.

Question 19

Do you help with GDPR compliance?

Accepted Answer

Yes, we integrate GDPR requirements into our cyber governance and crisis management missions. We support you on personal data protection, impact assessments (DPIA), breach notification procedures, and the alignment between security and data protection.

Question 20

How long does it take to obtain ISO 27001 certification?

Accepted Answer

The average timeframe is 12 to 18 months depending on your organization's initial maturity. This process includes: existing state analysis, ISMS implementation, documentation, training, internal audit, 2-phase certification audit, and any corrective actions.

Question 21

What should I do during an ongoing cyberattack?

Accepted Answer

If an attack is detected: 1) Immediately isolate compromised systems, 2) Do not pay ransom, 3) Contact your security officer/CISO, 4) Preserve evidence, 5) Contact us urgently (24/7 hotline available for clients under contract), 6) Notify relevant authorities (ANSSI, CNIL if personal data involved).

Question 22

Do you offer outsourced CISO services?

Accepted Answer

Yes, we offer part-time CISO services (1 to 4 days/week) for organizations that do not have the means or need for a full-time CISO. This service includes cyber governance, security project management, risk management, and regulatory compliance.

Question 23

What is a tabletop crisis exercise?

Accepted Answer

A tabletop crisis exercise is a guided simulation of a major incident scenario (ransomware, data breach, etc.) with key stakeholders. Without impacting actual systems, it allows testing your procedures, identifying gaps, training teams, and improving coordination during crisis situations.

Question 24

What is cyber-resilience?

Accepted Answer

Cyber-resilience is an organization's ability to anticipate, resist, recover, and evolve in the face of cyberattacks and incidents. It goes beyond simple cybersecurity by integrating business continuity, crisis management, adaptability, and continuous learning to maintain operations even during an incident.

Frequently Asked Questions