https://adventurespirit.hr/en/blog/ Expert articles on the Croatian Cybersecurity Act, the 13 measures of the Regulation, self-assessment scoring, incident reporting, ISO standards and risk management. en https://adventurespirit.hr/en/blog/how-self-assessment-is-scored/ https://adventurespirit.hr/en/blog/how-self-assessment-is-scored/ Self-assessment Tue, 01 Sep 2026 09:00:00 +0200 An explanation of the scoring system in the ZSIS evaluation framework: the minimum threshold per control, the additional average threshold per sub-measure, and why formal compliance is not enough. https://adventurespirit.hr/en/blog/active-directory-attack-paths/ https://adventurespirit.hr/en/blog/active-directory-attack-paths/ Offensive security Tue, 18 Aug 2026 09:00:00 +0200 The most common findings in Active Directory security assessments: legacy protocols, excessive delegation, passwords in attributes, stale privileged group membership, and access to domain backups. https://adventurespirit.hr/en/blog/security-culture-and-the-human-factor/ https://adventurespirit.hr/en/blog/security-culture-and-the-human-factor/ Human factor Tue, 11 Aug 2026 09:00:00 +0200 How to approach security awareness so it changes behaviour rather than just producing records: what to measure, building a reporting culture, and the link to measure 5 of Annex II. https://adventurespirit.hr/en/blog/ai-in-defence-where-it-helps/ https://adventurespirit.hr/en/blog/ai-in-defence-where-it-helps/ Artificial intelligence Tue, 04 Aug 2026 09:00:00 +0200 A realistic assessment of applying AI in cyber defence: where it delivers measurable benefit, where it creates false confidence, and which controls to put in place before adopting it. https://adventurespirit.hr/en/blog/nist-csf-2-govern-function/ https://adventurespirit.hr/en/blog/nist-csf-2-govern-function/ Frameworks Tue, 28 Jul 2026 09:00:00 +0200 What the Govern function brings to NIST Cybersecurity Framework 2.0, how the six functions map to the 13 measures of the Croatian Cybersecurity Regulation, and why the framework is worth using as a common language with the board. https://adventurespirit.hr/en/blog/cybersecurity-audit-how-it-works/ https://adventurespirit.hr/en/blog/cybersecurity-audit-how-it-works/ Self-assessment Tue, 21 Jul 2026 09:00:00 +0200 How the independent cybersecurity audit of essential entities runs: who may perform it, the steps of the process, how the auditor scores documentation and implementation, and which evidence is most often rejected. https://adventurespirit.hr/en/blog/ai-inventory-and-asset-register/ https://adventurespirit.hr/en/blog/ai-inventory-and-asset-register/ Artificial intelligence Tue, 14 Jul 2026 09:00:00 +0200 How to extend an existing information asset register so it covers the AI Act's inventory requirements, instead of maintaining a separate register of AI systems. https://adventurespirit.hr/en/blog/what-cyber-insurers-actually-ask/ https://adventurespirit.hr/en/blog/what-cyber-insurers-actually-ask/ Cyber insurance Tue, 07 Jul 2026 09:00:00 +0200 Which questions recur in cyber insurance questionnaires, why premium and cover are tied to specific controls, and how to use your existing compliance evidence in the negotiation. https://adventurespirit.hr/en/blog/prohibited-practices-and-ai-literacy/ https://adventurespirit.hr/en/blog/prohibited-practices-and-ai-literacy/ Artificial intelligence Tue, 30 Jun 2026 09:00:00 +0200 Which practices the AI Act prohibits outright, what the AI literacy obligation in Article 4 means, and how to satisfy it without building a separate training programme. https://adventurespirit.hr/en/blog/penalties-under-the-cybersecurity-act/ https://adventurespirit.hr/en/blog/penalties-under-the-cybersecurity-act/ CSA / NIS2 Tue, 23 Jun 2026 09:00:00 +0200 The penalty provisions of the Croatian Cybersecurity Act: ranges for essential and important entities, personal liability of management body members, the circumstances affecting the amount, and the rule against double punishment with the data protection authority. https://adventurespirit.hr/en/blog/dora-register-of-information/ https://adventurespirit.hr/en/blog/dora-register-of-information/ DORA Tue, 16 Jun 2026 09:00:00 +0200 What DORA requires in the register of information on contractual arrangements with ICT service providers, why populating it stalls on data quality, and how to connect it to your existing asset and risk registers. https://adventurespirit.hr/en/blog/ai-act-risk-levels/ https://adventurespirit.hr/en/blog/ai-act-risk-levels/ Artificial intelligence Tue, 02 Jun 2026 09:00:00 +0200 How the EU AI Act divides systems into four risk levels, what makes a system high-risk, and why classification has to start from an inventory of the AI systems in your organisation. https://adventurespirit.hr/en/blog/bia-that-produces-a-usable-rto/ https://adventurespirit.hr/en/blog/bia-that-produces-a-usable-rto/ Business continuity Tue, 26 May 2026 09:00:00 +0200 How to run a business impact analysis under ISO 22301 so that RTO and RPO are usable: who supplies the data, how to avoid everything being critical, and how the BIA connects to measure 12 of the Croatian Cybersecurity Regulation. https://adventurespirit.hr/en/blog/iso-27002-2022-control-attributes/ https://adventurespirit.hr/en/blog/iso-27002-2022-control-attributes/ ISO standards Tue, 05 May 2026 09:00:00 +0200 What changed in ISO/IEC 27002:2022 - four themes instead of fourteen clauses, 93 controls and five attributes. How to migrate an existing Statement of Applicability without losing the evidence base. https://adventurespirit.hr/en/blog/incident-reporting-deadlines/ https://adventurespirit.hr/en/blog/incident-reporting-deadlines/ Incidents Tue, 14 Apr 2026 09:00:00 +0200 Deadlines for reporting a significant cyber incident under the Croatian Cybersecurity Act: early warning within 24 hours, notification within 72 hours, final report within 30 days, and the parallel notification under Article 33 GDPR. https://adventurespirit.hr/en/blog/risk-register-that-passes-review/ https://adventurespirit.hr/en/blog/risk-register-that-passes-review/ Risk management Tue, 24 Mar 2026 09:00:00 +0200 The most common mistakes in risk registers that surface during compliance reviews: no link to the asset inventory, risks without owners, scores without reasoning, treatment plans without deadlines, and a register that never changes. https://adventurespirit.hr/en/blog/iso-27001-and-the-cybersecurity-act/ https://adventurespirit.hr/en/blog/iso-27001-and-the-cybersecurity-act/ ISO standards Tue, 03 Mar 2026 09:00:00 +0200 How much of the 13 measures of the Croatian Cybersecurity Regulation is covered by ISO/IEC 27001:2022, where the real gaps are, and how to map existing controls instead of writing new documentation. https://adventurespirit.hr/en/blog/correlation-of-measures-to-standards/ https://adventurespirit.hr/en/blog/correlation-of-measures-to-standards/ CSA / NIS2 Tue, 24 Feb 2026 09:00:00 +0200 What the correlation overview required by Article 49 of the Croatian Cybersecurity Regulation is, which standards it maps to, and how to use it so existing ISO or NIST documentation is not written twice. https://adventurespirit.hr/en/blog/thirteen-measures-annex-ii/ https://adventurespirit.hr/en/blog/thirteen-measures-annex-ii/ CSA / NIS2 Tue, 10 Feb 2026 09:00:00 +0200 A complete overview of the 13 cyber risk management measures from Annex II of the Croatian Cybersecurity Regulation: sub-measures per measure, what each asks for in practice, and how they connect to the control catalogue. https://adventurespirit.hr/en/blog/entity-categorisation-croatian-cybersecurity-act/ https://adventurespirit.hr/en/blog/entity-categorisation-croatian-cybersecurity-act/ CSA / NIS2 Tue, 20 Jan 2026 09:00:00 +0200 How it is determined whether you are an essential or an important entity under the Croatian Cybersecurity Act, which deadlines run from the categorisation notice, and how the duties of the two groups differ.