30. October 2026
At 7 p.m. on Wednesday, 21 October, the Czech Government Office took its website offline. By 8 a.m. on Thursday, it was back up and running. The shutdown was a precautionary measure in response to two critical PHP vulnerabilities known as PHP2Shell, which allow attackers to execute arbitrary code on a server without logging in. NÚKIB issued an advisory on the vulnerabilities, recommending immediate updates.
We’ve been seeing a lot of days like this lately. A few weeks ago, a data breach at Rohlik through its customer support system; now, server outages and patching around the world. Incidents, NÚKIB notifications, remediation measures.
What’s interesting, though, is what made the difference on Wednesday evening between an hour’s work and three days of it. It wasn’t a question of how to update PHP — every system administrator knows that. The real questions were: Where exactly are we running PHP, who is responsible for those systems, and what breaks if we take them all down right now?
And one more detail. According to analysts at Wiz, the vulnerability had been sitting in the code for more than ten years and was only discovered through analysis by a language model. Your exposure didn’t change on Wednesday. The only thing that changed was that you became aware of it.
When preparing clients for similar situations, I keep seeing the same pattern: systems with no designated owner, no assessed impact, and suppliers who have never undergone an assessment. Yet business processes depend on these systems, and they hold important data.
This isn’t a paperwork problem. It’s a management problem. If I don’t know an asset exists, I can’t decide whether to accept or mitigate its risk. It won’t be included in any continuity plan, nobody will configure backups according to its criticality, and when an incident occurs, the first question is, “Who actually operates this system?” That’s the most expensive question you can possibly start with.
The Czech Cybersecurity Act does not recognise the concept of a “corporate group”. Obligations apply separately to each legal entity — meaning that a business that operates as a single organism every day suddenly needs three or five separate management systems.
What gets lost in practice:
● Time during an incident. A shared ERP system or network appears differently in each company’s risk analysis, or not at all, because “head office takes care of that”. Unclear ownership of assets prolongs recovery.
● Business opportunities. It takes you three weeks to respond to a customer’s security questionnaire because you’re collecting the information from five Excel spreadsheets. Your competitor responds in three days.
● Management decisions. One plant assesses impact numerically, another describes it in words. You can’t compare where the risk is greater, so the budget ends up being allocated according to who pushes hardest.
NÚKIB has issued a warning about data transfers and remote administration originating from China, followed last August by a strategic analysis of Chinese connected vehicles. Meanwhile, Norwegian public transport operator Ruter discovered hidden SIM cards in its Chinese electric buses during its own testing. These cards could potentially have enabled remote access to the vehicles. Ruter removed them and tightened its procurement rules.
Now consider how the same risk is assessed across a corporate group. At an accounting firm where one employee owns an electric car, the asset might not even make it into the asset register. At a distribution company using the same type of vehicle to deliver goods to customers, it represents a risk capable of bringing revenue to a halt. The same threat, two completely different outcomes — and both assessments are correct.
Here’s the trap holding companies fall into: merging everything into a single register and managing the entire group using one number. The result is a blurry average. For the distribution company, the risk is understated, leaving the actual exposure unaddressed. For the accounting firm, it is overstated, so money is spent on something that poses no real threat to its business. An average helps neither.
We don’t sell a tool and leave clients to populate it themselves. An empty system is worse than an Excel spreadsheet because it creates the illusion that the job is done.
BS Shield vCISO means that the responsibilities of a cybersecurity manager are taken over by someone who has done the job elsewhere, too. Within 30 days, you receive a written roadmap setting out priorities for the year ahead. A backup vCISO is appointed from the outset, so the function doesn’t depend on a single person — which, incidentally, is exactly why documentation so often falls out of date.
We use MoyaKybeon as our GRC platform. Here’s how we use it across a corporate group:
● One legal entity, one view — and that’s a good thing. You always work with a single organisation in the system. There is no consolidated view across all companies in the group, and we don’t want one: that would create exactly the kind of blurry average described above. One person can still have access to all organisations, so central oversight of the methodology works as intended.
● The same process, individual assessments. We prepare catalogues of threats, vulnerabilities and standard asset types once, then transfer them to other companies. Each company must assess them independently — and it has to. A server room fire is critical for an IT services provider but merely disruptive for a bakery. The same principle applies to impact scales: a critical financial loss might amount to hundreds of thousands of Czech crowns for a small company, while for a large one, the same amount would be a rounding error.
● Risks are calculated consistently every time. No arithmetic errors in spreadsheets, no improvised formulas at individual sites. This makes values comparable across companies and, crucially, traceable: for every risk, you can see why it scored highly in one company — because both the threat and the asset were rated highly — and low in another.
● Every asset gets an owner — including those nobody thinks of as systems. A cloud-based helpdesk, MES, time and attendance software, a shared network. Relationships between assets, services and information are mapped, with weighted impact values, so impact assessments propagate automatically. When the value of a service changes, the entire chain is recalculated, not just one spreadsheet cell.
● Each company assesses its own suppliers. And rightly so: Microsoft may be a critical supplier for one company in the group and an ordinary one for another. What they share is the methodology — and the ability to use the same data to answer their customers’ security questionnaires, which are arriving faster than inspections.
● Impact analysis produces numbers, not just documents. Business processes are linked to assets, from which MTO, RTO and RPO values are derived. The operations director then knows that a production line can operate for eighteen hours without ERP and ninety minutes without the network. That’s the difference between a continuity plan written for an auditor and one that can actually guide decisions during a crisis.
● An acquisition or a new system becomes a managed process, not an email. Corporate groups are constantly acquiring and merging businesses. Every significant change triggers a risk analysis, with a named approver and proposed mitigation measures to ensure a smooth transition. It’s no longer something someone remembers just before an audit.
No measure can reduce the probability of an incident to zero. That’s why there’s a second half to the job: limiting the impact.
The vCISO prepares the incident response plan before anything happens, including procedures for communicating with NÚKIB. And for the data that keeps the business running, we deploy BS Shield CyberVault: an isolated vault with no permanent connection to production systems, an immutable copy, integrity checks and regularly tested recovery. An attacker may compromise production, but cannot access a verified clean copy.
The difference between a company that has prepared for this and one that hasn’t isn’t measured in audit findings. It’s measured in days of downtime.
The quickest way to find out whether this approach is right for you is to see what it could look like in your organisation — not in a presentation.
The demo is free for 30 days, with no credit card required. We’ll walk you through it using sample data from a manufacturing company, so you can see where information is entered and what the system produces. If you then want to work with your own data, we’ll agree on what to bring into the system and how to do it.
Licences are charged per organisation, with no limit on the number of users. This means you can give asset owners and task managers access to the system at no additional cost. And if you’re managing more than one legal entity, the annual cost for each additional company from the fourth entity in the group is in the low thousands of Czech crowns.
Petr Diviš, Security Consultant, BIT SERVIS