Industries

Cybersecurity for banks, government, and industry, shaped by the environment it protects.

The practices are the same. The risks, deadlines, and reviewers differ by sector. Here is where each practice usually fits.

Banking, payments, and fintech

Controls and evidence for payment and banking environments, including the Central Bank of Egypt cybersecurity framework, PCI DSS, and SAMA CSF where those obligations apply.

Risks we hear about

Customer and regulator reviews with fixed dates
Payment and customer-facing applications exposed to the internet
Evidence that has to hold up under audit

Relevant practices

Telecom and digital services

Protection for the platforms, the customer data, and the availability those businesses sell. NTRA requirements are named where they apply.

Risks we hear about

Platforms whose availability is the product
Large volumes of customer data
Alerts at all hours across a broad estate

Relevant practices

Industry, manufacturing, and critical infrastructure

Testing and monitoring planned so a production environment stays up, including OT/ICS where that is in scope. NCA ECC is named where that obligation applies.

Risks we hear about

Production environments that cannot stop for testing
Connected systems between the office and operations
Teams that need to recognize an incident early

Relevant practices

Technology and SaaS

A security program that can pass a customer review without burying a small team. ISO 27001 is the usual framework, and SOC 2 is named when a customer requires it.

Risks we hear about

Customer security questionnaires that have become projects
A small team carrying security alongside product work
Cloud accounts and APIs that grew faster than their controls

Relevant practices

Government and public sector

Governance, monitoring, and training for public bodies. The NCA Essential Cybersecurity Controls are named where that obligation applies.

Risks we hear about

Obligations such as the NCA ECC, where they apply
The need for staffed monitoring and incident response
Teams that have to run the program after the engagement

Relevant practices

Healthcare

Systems that hold personal data, including Egypt's Personal Data Protection Law where that obligation applies.

Risks we hear about

Personal data obligations under Egypt's PDPL
Applications and networks that need an independent test
Monitoring for clinical and administrative systems

Relevant practices

Oil, gas, and energy

Testing and monitoring for operational environments, including OT/ICS where that is in scope.

Risks we hear about

OT/ICS and SCADA environments that need a planned test
The need for staffed monitoring
Governance of the controls around those environments

Relevant practices

Insurance and non-bank finance

Governance and testing where FRA requirements apply, alongside the applications those firms run.

Risks we hear about

FRA requirements for non-bank finance
Applications that need a penetration test
Monitoring and response outside office hours

Relevant practices

Retail and e-commerce

Customer-facing stores and payment flows, including PCI DSS where card data is in scope.

Risks we hear about

Cardholder data and PCI DSS where card data is in scope
Web and API paths exposed to customers
Alerts that need an owner after the shop closes

Relevant practices

Education

Training for the people who run the institution, plus testing and monitoring of the systems they rely on.

Risks we hear about

People who need security awareness and practice
Applications and networks the institution relies on
Monitoring when the security team is small

Relevant practices

Talk to our security experts

Not sure which practice fits your environment?

Describe the environment and the pressure you are under. We will tell you where we would start.

Discuss Your Security Needs info@cleopatrasiliconvalley.com