Ciberseguridad720 in every sector
Cybersecurity by sector:risks, regulation and services
A hospital is not protected the same way as an online shop. Each sector has its own threats and rules: DORA in finance, health data in healthcare, OT systems in industry, ENS in the public sector, professional secrecy in law firms, PCI DSS in retail and children’s data in education. Pick yours to see the risks we see, the rules that apply and how we help.
Cybersecurity for the financial sector
Banks, insurers, payment institutions, asset managers and their technology providers handle money and customer data, and regulation requires them to prove digital operational resilience.
What worries them most
- Fraud and impersonation of customers and executives (phishing, BEC)
- Ransomware that stops operations and payment channels
- ICT third-party and cloud provider risk
- Theft of banking and internal access credentials
Rules that apply
- DORA
- Regulation (EU) 2022/2554, applicable since 17 January 2025: ICT risk management, incident reporting, resilience testing and ICT third-party oversight.
- PCI DSS
- Mandatory for anyone who stores, processes or transmits card data.
- GDPR
- Protection of customer personal data and breach notification within 72 hours.
How we help
- Penetration testing and vulnerability management
- 24/7 SOC/MDR and managed EDR
- DORA readiness and third-party management
- Tested continuity and recovery
Whether each regulation applies depends on the size and activity of the company; we review it in the diagnostic.
Cybersecurity for healthcare
Clinics, hospitals, laboratories and medical centres handle specially protected data and cannot stop patient care because of an incident.
What worries them most
- Ransomware that locks medical records and appointments
- Leaks of patient health data
- Connected medical equipment that is not updated
- Remote access by suppliers and staff
Rules that apply
- GDPR
- Health data is a special category (art. 9): it requires stronger measures and breach notification within 72 hours.
- NIS2
- Lists healthcare providers among the sectors of high criticality when they exceed the size threshold.
How we help
- Managed EDR and 24/7 SOC
- Immutable backups and continuity plan
- Access audit and segmentation
- GDPR and NIS2 compliance
Whether each regulation applies depends on the size and activity of the company; we review it in the diagnostic.
Industrial cybersecurity (IT and OT)
In industry an incident does not only affect data: it can stop production. Security has to cover the office network (IT) and the plant network (OT).
What worries them most
- Ransomware jumping from the office network to the plant
- Uncontrolled remote maintenance access
- Old, unpatched control systems (PLC, SCADA)
- Theft of designs and industrial property
Rules that apply
- NIS2
- Covers energy, transport and water as sectors of high criticality, and part of manufacturing (for example chemicals, food or machinery) as other critical sectors.
- IEC 62443
- The reference family of standards for the security of industrial automation and control systems.
How we help
- IT/OT segmentation audit and penetration testing
- 24/7 monitoring and response
- Production continuity plan
- NIS2 readiness
Whether each regulation applies depends on the size and activity of the company; we review it in the diagnostic.
Cybersecurity for the public sector and its suppliers
Spanish public bodies and the companies that provide them with technology services must comply with the National Security Framework (ENS).
What worries them most
- Ransomware that interrupts services to citizens
- Phishing aimed at public staff
- Exposure of citizens’ data
- Security requirements in public tenders
Rules that apply
- ENS
- Royal Decree 311/2022: mandatory for the Spanish public sector and for suppliers providing it with technology services or solutions, with Basic, Medium and High categories.
- NIS2
- Lists public administration among the sectors of high criticality.
How we help
- ENS readiness and certification preparation
- Audits and penetration testing
- 24/7 SOC and managed EDR
- Internet exposure with OSINT720
Whether each regulation applies depends on the size and activity of the company; we review it in the diagnostic.
Cybersecurity for law firms and advisory firms
Law firms, notaries and advisory firms hold confidential client information and are a frequent target of email fraud.
What worries them most
- CEO fraud and bank account changes by email (BEC)
- Theft of case files and confidential documents
- Email accounts without two-factor authentication
- Laptops and phones outside the office
Rules that apply
- GDPR
- Client personal data, sometimes of special categories, and breach notification within 72 hours.
- Professional secrecy
- The duty of confidentiality also requires protecting client information technically.
How we help
- Managed EDR and email protection
- Awareness training and phishing simulation
- What the Internet knows about the firm (OSINT720)
- GDPR compliance
Whether each regulation applies depends on the size and activity of the company; we review it in the diagnostic.
Cybersecurity for retail and e-commerce
Physical and online shops combine card data, logistics and sales peaks when an outage is expensive.
What worries them most
- Card data theft in the online shop (web skimming)
- Fraud and customer account takeover
- Website or point-of-sale outages during campaigns
- Leaks of customer databases
Rules that apply
- PCI DSS v4.0
- The card industry security standard; its new requirements have been mandatory since 31 March 2025.
- GDPR
- Customer and marketing data, and breach notification within 72 hours.
How we help
- Web and API penetration testing
- 24/7 SOC and EDR in shops and offices
- Leaks and brand impersonation (OSINT720)
- Continuity during campaigns
Whether each regulation applies depends on the size and activity of the company; we review it in the diagnostic.
Cybersecurity for schools and universities
Schools, academies and universities manage thousands of student and staff accounts, often with small IT teams.
What worries them most
- Ransomware that locks platforms and records
- Takeover of student and teacher accounts
- Exposed children’s data
- Personal devices on the school network
Rules that apply
- GDPR
- Stronger protection of children’s data and breach notification within 72 hours.
- ENS
- Applies to Spanish public schools and universities and to their technology suppliers.
How we help
- Awareness training for staff and students
- Managed EDR and 24/7 SOC
- Backups and platform recovery
- GDPR and ENS compliance
Whether each regulation applies depends on the size and activity of the company; we review it in the diagnostic.
Frequently asked questions about cybersecurity by sector
We do not publish client names. In the diagnostic we explain how we apply each service to your activity and which regulations we take into account.
It depends on the sector (Annexes I and II of the Directive) and on size: generally from 50 employees or 10 million euros in turnover. If you supply an entity in scope, you will also be asked for measures.
Yes. EDR, SOC, backups and penetration testing are common; what changes is the priority, the regulation and the evidence each sector needs.
Don’t see your sector?
Tell us what your company does and we will tell you which risks and obligations we see first.