Reliable backups verified through actual restoration, continuous monitoring, and a ready response plan, with the LFPDPPP and GDPR set up prior to the incident.
![[interface] screenshot of core features (for an AI legal tech company)](https://cdn.prod.website-files.com/6a0029a6f31182220001f475/6a318c6d5ce15fb85e88c8fe_6a318065570227777ccce860_Cybersecurity%2520by%2520Keptos.jpeg)
Reliable backups proven through actual restores—not just reports of successful backups
MFA phishing resistance and the principle of least privilege for all administrative access
Documented compliance with LFPDPPP and GDPR , with notification deadlines established in advance
The difference between being protected and believing you are protected becomes clear on the day of the incident.
Incident response plan with designated roles, a contact tree, and already identified legal notification obligations
Periodic restoration tests using real data, with a report of results and measured recovery time
Staff training through simulated phishing campaigns, with click-through rates tracked on a quarterly basis
A device being tested, not a list of installed tools.
Security failures are almost always caused by a person under pressure, not by improperly configured technology. We address both issues.
Almost all of the companies that were attacked had antivirus software, firewalls, and backups. What they lacked was the certainty that everything would work together on the day of the incident.
An impact analysis defines the RTO and RPO for each system. Without those values, any security budget is arbitrary.
Identity management with MFA, email, systems with EDR, network segmentation, and backups as a last line of defense. No single tool can stop an attack on its own.
We perform recovery in an isolated environment, measure the recovery time, and document the process. The backups are immutable.
Simulated phishing attacks without prior warning and training in your language. We track the click-through and reporting rates every quarter.
A quarterly drill based on a real-life scenario, with a response plan and the required obligations as outlined at LFPDPPP and GDPR .
Backups, RTO, incident response, cyber risk insurance, and legal obligations in Mexico: What a management committee asks.
Comprehensive 360° service: impact analysis, DRP , automated backups, 24/7 monitoring, incident drills, and staff training. All managed by our SOC in Mexico City.
Typically 4 to 6 weeks, depending on the size of the company: 1 week of analysis, 2–3 weeks of implementation, and 1–2 weeks of drills and training.
We conduct quarterly drills based on real-world scenarios: ransomware, data loss, and DDoS attacks. We test our procedures, measure recovery times, and provide a report highlighting areas for improvement.
In most cases, no: we leverage your existing infrastructure using software tools (EDR, cloud-based SIEM). If specific hardware is required (NGFW firewall, IDS sensors), it is included in the quote.
Because we test them. A "backup successful" report only confirms that files were copied, not that you can recover them.
We conduct periodic recovery tests using real data in an isolated environment and measure the time it takes to resume operations. Each test generates a report detailing the results and any deviations detected. It’s the only honest way to answer the question that matters: How long will it take for us to get back to work?
In addition, backups are immutable: once created, they cannot be modified or deleted during the retention period, not even with administrator credentials. Modern ransomware targets backups first.
We don't provide a single figure, because not all of its applications are equally valuable when halted.
During the impact analysis, we define two values for each application: the RTO (how long the application can be down before the damage becomes unacceptable) and the RPO (how much data can be lost). A production ERP and a historical file server do not have the same values, nor do they have the same protection costs.
These objectives are documented, tested in drills, and reviewed annually.
The response plan is activated with designated roles, not ad hoc ones: who decides to isolate a system, who informs management, who speaks with customers, and who contacts the insurer.
The first few hours follow a set sequence: containment, evidence preservation, assessment of the scope, and then restoration. Preserving the evidence before restoration is what allows you to understand what happened and respond to your insurer and the authorities.
Upon completion, we submit a post-incident report: timeline, root cause, affected data, and corrective actions.
Cyber risk insurers no longer provide coverage without conditions. Most now require MFA for remote and administrative access, EDR deployed on devices, immutable backups, and a documented response plan.
We ensure your device meets those requirements and provide you with the technical documentation the insurer requests, both when taking out a policy and after a claim. A policy rejected due to noncompliance with a technical provision costs more than the premium.
We conducted simulated phishing campaigns sent to staff without prior notice, followed by training for those who clicked on the links. We tracked the click-through rate and the reporting rate on a quarter-by-quarter basis.
Our goal is not to point fingers, but to foster a culture of reporting. An employee who speaks up within two minutes is worth more than an employee who never makes a mistake.
The training is conducted in Spanish, English, or French, depending on each team's language.
The General Data Protection Regulation ( LFPDPPP ) requires the data controller to immediately notify the affected data subjects when a breach significantly impacts their economic or moral rights, so that they can take appropriate action.
If your organization processes data belonging to European residents, the General Data Protection Regulation ( GDPR) also applies, with its 72-hour deadline for notifying the supervisory authority.
We prepare the decision-making framework in advance: what data is at stake, who assesses the severity, what is communicated, and to whom. Improvising this during a crisis is what turns a technical incident into a reputational and legal problem. This content is for informational purposes only and is not a substitute for advice from your legal department.
International subsidiaries and companies in Mexico that entrust their IT to Keptos.
Keptos IT Services has proven to be a reliable, responsible, and professional company, fulfilling its commitments in a timely manner and providing high-quality services. We highly recommend their services.
During every service call, the technical staff has demonstrated professionalism, punctuality, and a solution-oriented attitude. Thanks to their support, we have been able to improve the operational continuity of our activities.
Please provide your contact information, and a specialist from Keptos will contact you within one business day.
Thank you! We have received your request. We will be in touch soon.
An error occurred while submitting the form. Please try again.