Auditní a poradenské služby v oblasti kybernetické bezpečnosti

The contract duration is 48 months from the effective date of the contract, or until the financial limit is exhausted, whichever comes first. The term for the completion of the main work (dílo) is 3 months from the effective date of the Contract. A detailed schedule with partial time milestones is outlined in Appendix No. 1 of the Contract.

Key milestones mentioned are:

• M1 (Kick-off and environment mapping): The audit is to commence within 10 working days from the contract's effective date, with data collection, interviews, and IT environment mapping occurring during this phase. The "Discovery Report" (written overview of mapped assets, systems, and audit scope) is due within 20 working days from the contract's effective date and accounts for 10% of the total remuneration.
• M2 (Technical audit and penetration testing): This involves performing audit activities, including for IS, network infrastructure, and M365, as well as penetration testing. The output is a continuous technical report.
• M3: A five-day feedback period is associated with this milestone.
• M4: This milestone is mentioned in relation to invoicing, which is permissible only after the final acceptance of the entire work.

It is noted that contractual penalties for delays apply to the final deadline, not to individual milestones.

• Wi-Fi
• VPN
• MDM
• Microsoft 365
• Entra ID
• Active Directory
• Black box (testing mode)
• Grey box (testing mode)
• Penetration testing
• Configurational security audit
• DoS or DDoS tests are not permitted without explicit written consent.
• Destructive methods are not permitted without explicit written consent.
• Intentional changes or deletion of production data are not permitted.
• Mass password guessing with the risk of account blocking is not permitted.
• Installation of permanent access mechanisms or persistence is not permitted.
• Testing of assets outside the approved scope is not permitted.
• Testing must not pose an undue risk to the availability or integrity of services in the production environment.
• Risky, destructive, or operationally burdensome methods require a test environment or explicit prior written consent.
• Immediate interruption of testing is required upon detection of risk of outage, data damage/loss, operational disruption, uncontrolled spread of testing activity, or other stop conditions.