Skip to content

Esta página también está disponible en español.

Ver en español
Almenara

Demo · six steps

Your cloud provider goes down. You know what stops, what to report and who does what

Walk through an incident from start to finish with platform screens. Almenara keeps what you need in one place: it brings the notice to the supplier record, matches it against your impact analysis to tell you how much time you have, and leaves the notification filled in for you to review and send.

Sample data

NIS2 is the EU cybersecurity directive (Directive (EU) 2022/2555).

  1. 09:12

    +0 min since the notice

    Simulated screen: record of your cloud provider, marked as critical, with an amber dot and the 09:12 notice: database service outage in the EU region.
    Third parties › Your cloud provider

    Sample data

    Your cloud provider

    Managed database, EU region

    Critical

    Supplier notice, from its portal

    Database service outage in the EU region

    Linked to this record

    3 functions depend on it

    Step 1 of 6 · Third parties

    The notice arrives

    At 09:12 your cloud provider posts an outage of its database service in the EU region on its portal. It doesn’t depend on someone reading an email in time: Almenara picks up the notice and links it to the supplier record, which you have already marked as critical.

    What you take away

    You hear about it through Almenara, and the notice arrives already linked to the supplier record.

  2. 09:12

    +0 min since the notice

    Simulated screen: three functions depend on the supplier: online orders can be down for 2 hours, invoicing for 4 hours and customer service for 24 hours. A clock runs from 09:12.
    Continuity › What depends on your cloud provider

    Sample data

    Now 09:12

    • Online ordersRTO 2 h2 h left
    • InvoicingRTO 4 h4 h left
    • Customer serviceRTO 24 h24 h left

    From your business impact analysis (BIA)

    Step 2 of 6 · Continuity

    You see what stops

    The record shows the functions that depend on that supplier. Each one carries its RTO (the longest it can be down before the damage is unacceptable), which you set in your business impact analysis (BIA). The clock runs from the notice.

    What you take away

    Almenara matches the notice against your impact analysis: you know what breaks and how much time you have.

  3. 09:40

    +28 min since the notice

    Simulated screen: incident classification with the criteria met, the outcome and the reports due, each with its deadline.
    Incidents › Your cloud provider outage

    Sample data

    Classified by your security lead

    Criteria

    • Severe operational disruption of a service · Met
    • Financial losses for your company · Met
    • Considerable damage to other people or organisations · Not met

    Significant incident: you report to the competent CSIRT

    Deadlines · Competent CSIRT

    1. Early warning · Due +1 d 09:12

      24 h from awareness

    2. Incident notification · Due +3 d 09:12

      72 h from awareness

    3. Final report · Counts from the previous report

      1 month from the notification

    Directive (EU) 2022/2555 (NIS2), art. 23.

    Step 3 of 6 · Incidents

    Is it serious?

    At 09:40 your security lead classifies the incident against your regime’s criteria. Almenara marks which criteria are met using the inventory and impact analysis data, and tells you which reports are due, each with its deadline.

    What you take away

    You know whether you have to report, to whom and when, before the clock starts running.

  4. 09:44

    +32 min since the notice

    Simulated screen: continuity plan activated at 09:44 with three tasks and their owners; the first, the manual ordering procedure, is done. Next to it, the incident timeline.
    Continuity › Plan: your cloud provider outage

    Sample data

    Plan activated

    • Move orders to the manual procedure (phone and form)

      Your operations leadDone · 09:58

    • Brief customer service with the prepared message

      Your customer service leadIn progress

    • Confirm the estimated recovery time

      Your cloud provider, from a link, no accountPending

    Timeline

    1. 09:12 Supplier notice
    2. 09:40 Incident classified
    3. 09:44 Plan activated
    4. 09:58 Orders on manual

    Step 4 of 6 · Continuity

    The plan kicks in

    Once the incident is classified, the continuity plan for the cloud provider outage is activated. It isn’t more paperwork: it is the guide you had already prepared, so everyone knows what to do without improvising. Each task has an owner, and the first one is the manual ordering procedure. Your provider confirms the estimated recovery time from a link, without creating an account.

    What you take away

    Everything flows and stays in one place: everyone knows what to do, and what happens is recorded for any future audit.

  5. 10:40

    +1 h 28 min since the notice

    Simulated screen: draft of the first notification prepared at 10:40, with its margin before the deadline, each field with its source, and the person who reviews and sends it.
    Incidents › Notifications

    Sample data

    Early warning · Competent CSIRT

    Ready for reviewDue +1 d 09:12Margin: 22 h 32 min

    Affected supplierFrom the inventory
    Your cloud provider (critical)
    Affected servicesFrom the inventory
    Online orders, invoicing
    Detection timeFrom the incident
    09:12
    Could it be caused by an unlawful or malicious act?Confirmed by the reviewer
    No signs so far
    Could it affect other countries?Confirmed by the reviewer
    No

    Reviews and sends: your security lead

    Step 5 of 6 · Incidents

    Your notification is ready

    Almenara prepares the draft of the first notification and fills in the fields from the inventory and the incident record: supplier, affected services, detection time. Almenara sends nothing: what only a person can say is flagged, and your lead reviews it and sends it through the official channel.

    What you take away

    Almenara brings the data together and fills in the notification: your lead only reviews and sends.

  6. Afterwards

    Simulated screen: the incident evidence, stored once, and four frameworks that ask for it: ISO 27001, ENS, NIS2 and DORA. One open action: review the exit plan for your cloud provider. The supplier assessment, updated.
    Compliance › Evidence

    Sample data

    Incident record and notification sent

    Stored once

    Required by

    • ISO 27001 5.26
    • ENS op.exp.7
    • NIS2 art. 23
    • DORA art. 19

    Open action

    Review the exit plan for your cloud provider

    Your procurement lead

    Supplier assessment

    Updated with today’s incident. The review is still open.

    Step 6 of 6 · Compliance · Third parties

    What remains

    The incident leaves three things. The evidence (the record and the report sent) is stored once and every framework that asks for it has it. An action stays open, with an owner. And the assessment of your cloud provider is updated with what happened.

    What you take away

    One control, one piece of evidence, every framework that asks for it; and the supplier is back under review.

Summary

It all comes from a single inventory

Six steps on the same record. Here is what each one does in Almenara, and what it takes by hand without it.

  1. 01The notice arrives

    With Almenara

    You hear about it through Almenara, and the notice arrives already linked to the supplier record.

    By hand

    In the procurement spreadsheet, or by asking whoever signed the contract.

  2. 02You see what stops

    With Almenara

    Almenara matches the notice against your impact analysis: you know what breaks and how much time you have.

    By hand

    Someone digs the impact analysis out of a folder and works out how long each process can hold out.

  3. 03Is it serious?

    With Almenara

    You know whether you have to report, to whom and when, before the clock starts running.

    By hand

    The calculator works the same, but the provider’s criticality and the order process RTO have to be found and typed in.

  4. 04The plan kicks in

    With Almenara

    Everything flows and stays in one place: everyone knows what to do, and what happens is recorded for any future audit.

    By hand

    The plan lives in a document: someone has to find it, call people and note who does what.

  5. 05Your notification is ready

    With Almenara

    Almenara brings the data together and fills in the notification: your lead only reviews and sends.

    By hand

    The report goes out from Incidents, but the crisis timeline is rebuilt from emails and messages.

  6. 06What remains

    With Almenara

    One control, one piece of evidence, every framework that asks for it; and the supplier is back under review.

    By hand

    The report goes to the audit folder and the exit plan review to a list someone has to remember to check. When the provider’s assessment is due, someone has to search the incident log for what happened this year.

See it module by module

Shall we run it with your suppliers?

We show you the same case with your cloud provider, your processes and your regulatory regime. We reply within one working day.

Request information