Cyber Resilience Management

Materna’s cyber resilience programme comprises three key components: security and compliance, technical resilience, and monitoring and sustainable resilience. This includes, amongst other things, establishing clear governance and accountability structures, implementing regulatory requirements, protecting and hardening business-critical IT systems, effective monitoring and incident management, as well as exercises, audits and continuous improvement processes. In this way, we support organisations with a holistic approach that embeds resilience within the organisation, secures it technically and ensures it remains effective in day-to-day operations.

Materna recommends starting with a baseline assessment (resilience or maturity assessment): What critical services are in place, what do they depend on, what scenarios are realistic, and what regulatory requirements apply? From this, prioritised measures can be derived (quick wins and a roadmap) based on business impact, feasibility and risk.

Relevant key performance indicators depend on the specific context. These often include, amongst other things, control coverage rates, results from exercises or audits, mean time to detect/respond/recover (MTTD/MTTR), defined and achieved RTOs/RPOs for critical services, backup success rates, and the ability to provide evidence (documentation, responsibilities, reporting).

Depending on the sector and role, the focus is often on requirements set out in NIS2, DORA, KRITIS or the KRITIS umbrella law, as well as established standards and frameworks (e.g. ISO 27001/22301, BSI IT-Grundschutz, BSI 200-4). What they all have in common is that resilience must be embedded within the organisation, implemented effectively from a technical perspective, and verifiable to auditors.

Materna combines organisational, technical and operational measures: we begin with an assessment and a target vision, develop a roadmap and support implementation, covering areas such as governance, ISMS and BCM, technical hardening and architecture, monitoring and operational processes, runbooks, as well as exercises and audit evidence. The aim is an end-to-end approach that works sustainably in practice and delivers measurable results.

You will receive a clear assessment of your maturity level, a prioritised list of risks and dependencies relating to critical services, and an actionable plan of action (including quick wins and a roadmap). On request, the target architecture, operating model, roles, processes and verification artefacts can be defined in sufficient detail to ensure that implementation and operations can begin seamlessly.

Typically, a coordinated setup is required involving management (prioritisation and decision-making), information security or the CISO organisation, IT operations and infrastructure or the cloud, business units (critical processes), BCM and crisis management, as well as—depending on the context—data protection, legal affairs, procurement, and partner or supplier management. What matters is not so much ‘who is involved’, but rather that responsibilities, escalation procedures and interfaces are clearly defined and practised.