Adventure Spirit d.o.o. · Zagreb, Croatia +385 95 504 1496 info@adventurespirit.hr GRC Portal
Home›Sectors›Digital infrastructure and ICT
Sectors

Digital infrastructure and ICT

Here the size criterion often does not apply. DNS service providers and the national top-level domain registry are essential regardless of size, and providers of electronic communications and trust services are categorised regardless of size.

Annex to the ActAnnex I - high-criticality sector
Competent CSIRTNational Cyber Security Centre (NCSC-HR)
Sectoral authorityHAKOM for electronic communications

The measures that carry most of the work in this sector

07Access control
A managed service provider has access to its clients' systems - a compromise multiplies.
08Supply chain
You are somebody's supply chain. Your clients' measure 8 imposes requirements on you, contractually.
09Development and maintenance
Separated environments and change management are decisive when one change affects several clients.
11Incident handling
For some digital providers special significance rules apply under Implementing Regulation (EU) 2024/2690.

What we most often find

  • Shared administrator accounts across several clients
  • Remote management tools without multi-factor authentication
  • No network-level separation of client environments
  • Contracts with no defined incident notification deadline towards the client

Check for yourself

Tri alata koja rade u pregledniku, bez registracije:

Entity categorisation check Incident reporting deadline calculator Readiness check against the 13 measures

Not sure where you stand?

Half an hour of conversation, with no obligation. By the end you know what needs doing and in what order.

Book a conversation See our services

From the knowledge base

CSA / NIS2
Entity categorisation under the Croatian Cybersecurity Act, and what follows from it
You do not choose your category and you do not apply for it. It arrives by letter, and from that day a deadline runs. Here is who decides, on what basis, and what actually changes depending on which group you land in.
20 January 20267 min read
Offensive security
Active Directory: five findings we see in almost every assessment
Domain infrastructure rarely falls to an unpatched vulnerability. It falls to configuration that once made sense, was left behind, and that nobody looks at any more. These five findings show up in most environments.
18 August 20267 min read
ISO standards
ISO 27002:2022: 93 controls and the five attributes most people skip
The 2022 revision cut 114 controls to 93 and reorganised them into four themes instead of fourteen clauses. The bigger change is the attributes - and they are why an old Statement of Applicability cannot simply be renumbered.
5 May 20266 min read

All sectors

Banking and finance Insurance Energy Healthcare and pharma All sectors