Client: At EXPinIT Poland, we specialize in cyber risk management, helping businesses navigate complex compliance requirements and secure their digital environments. One of our recent projects involved an insurance sector client who migrated their systems to the cloud and needed to ensure compliance with KNF (Polish Financial Supervision Authority) regulations and DORA (Digital Operational Resilience Act) while aligning with NIST and ISO standards.

Here’s how we transformed their cybersecurity framework in three key stages:

1. Initial State: Compliance Gaps in a Cloud Migration

Our client, a leading insurance provider, had recently moved critical systems to the cloud but faced challenges in:

• ❌ Ensuring documentation alignment with KNF and DORA requirements.
• ❌ Assessing the technical compliance of their cloud infrastructure with NIST/ISO standards.
• ❌ Verifying whether their third-party suppliers met regulatory expectations.

Furthermore, there was no structured process for evaluating the compliance of third-party vendors or informing external stakeholders about the cloud solutions in use. This left the organization vulnerable to regulatory scrutiny and operational risk.

2. Our Analysis: A Deep Dive into Regulatory & Technical Alignment

EXPinIT was brought in to perform a full Cyber Risk Management assessment, which included:

⚙️ System Documentation Review

• We conducted a thorough analysis of the client’s system documentation to evaluate compliance with KNF communication and DORA regulations.

⚙️ Technical Compliance Assessment

• We assessed the level of compliance of the client’s cloud systems and technical solutions with KNF and DORA guidelines, as well as NIST and/or ISO standards.

⚙️ Third-Party Provider Evaluation

• We analyzed the compliance status of the client’s ICT and cloud providers. As part of this process, we designed and implemented a structured verification framework.

⚙️ Recommendations & Remediation Planning

• We provided detailed, actionable recommendations to close compliance gaps and achieve full alignment with the relevant regulations and standards.

⚙️ Stakeholder Communication Support

• We supported the client in preparing communication materials to inform their partners and stakeholders about the use of compliant ICT and cloud solutions.

3. Delivered Benefits: Secure, Compliant, and Future-Ready Through our collaboration, the client gained:

• ✅Full Regulatory Alignment – Systems and processes now meet KNF, DORA, NIST, and ISO requirements.
• ✅Strengthened Supplier Controls – A structured vendor verification process minimizes third-party risks.
• ✅Proactive Cyber Risk Management – Clear guidelines for maintaining compliance as regulations evolve.
• ✅Enhanced Partner Communication – Improved transparency with partners regarding cloud security measures.
• ✅Security and governance guidance
• ✅Execution roadmap with prioritized actions

Final Thought

Our client now operates with greater resilience, reduced regulatory risk, and a future-proof compliance strategy—all while leveraging the benefits of cloud technology.

At Expinit, we don’t just check boxes—we build secure, compliant, and efficient IT ecosystems.

Need help with cyber risk management?

Contact EXPinIT Poland today by reaching out to Mariusz Kamelak