Client brief — Isla Mercantile Group
Engagement request from Isla Mercantile Group to Eoncore. Handout for participants; one copy per pair. Everything in this brief is what the client believes about itself. Nothing in it has been verified.
1. The client
Isla Mercantile Group is a retail and payments group headquartered on Curaçao. It runs a webshop with its own payment service, a loyalty programme and an employee intranet. About 900 staff, of whom 45 in IT. Card payments are processed through a payment service provider; Isla holds a licence as a payment institution and falls under the local supervisor.
2. The ask
"We need to show our supervisor and our board where we stand on cryptography. DORA and NIS2 both ask for it, and our auditors keep raising it. On top of that the board has read about quantum computing and wants to know whether we need to act now. Tell us where we stand, what it costs to fix, and what we should do first."
— Maria Isenia, CISO
Two questions, one engagement:
| # | Question | Frame of reference |
|---|---|---|
| Q1 | Is our cryptography ready for DORA and NIS2? | DORA art. 9 (protection incl. encryption), art. 28–30 (ICT third parties); NIS2 art. 21(2)(h) (cryptography), 21(2)(d) (supply chain) |
| Q2 | How ready are we for post-quantum cryptography? | NIST FIPS 203/204/205, harvest-now-decrypt-later exposure |
3. Stakeholders
| Name | Role | What they want | Available for |
|---|---|---|---|
| Maria Isenia | CISO, engagement sponsor | A position she can defend to the supervisor and the board; a first-year plan with a budget | Kickoff, one interview (90 min), readout |
| Ruben Martina | IT manager | No surprises for his teams; a list he can plan against | Technical questions, access to systems and the intake spreadsheet |
| Sharon Doran | Procurement lead | Know which supplier contracts need changing and what to ask for | Supplier list, contract questions |
Application owners per team are reachable through Ruben Martina.
4. Scope
Four applications, all production:
| App | What it is | Responsible team | Public name(s) |
|---|---|---|---|
webshop | online shop, shop API, database, payment service | webteam (payment service: finance) | www, shop, api, pay .isla.edu.eoncore.net |
intranet | single sign-on, employee portal, cache | platform | intranet.isla.edu.eoncore.net |
payments | payment gateway, remote-access VPN, HSM proxy | finance | none |
loyalty | loyalty app and API | marketing | loyalty.isla.edu.eoncore.net |
Internal naming: <host>.<app>.isla.test, network 10.20.0.0/16. External domain: isla.edu.eoncore.net.
In scope:
- Cryptography in transit (TLS, VPN, SSH) and at rest for the four applications.
- Certificates and keys, including who owns them.
- The suppliers in section 6, as far as their cryptographic role goes.
- Policy and governance around cryptography.
Out of scope:
- Penetration testing or any active exploitation.
- Source code review.
- Office IT and end-user devices, except where they touch the four applications.
- Physical security of data centres.
- Non-cryptographic supplier aspects (price, SLA availability, legal terms beyond security clauses).
5. What the client has
- A cryptography policy (2021, owned by the CISO office). Not updated since.
- A CKM intake spreadsheet compiled by IT for this engagement (
ckm-intake.xlsx). Ruben Martina: "It lists every system. It should be complete." - A central register of public hosts and approved certificate issuers maintained by the platform team (
register.xlsx). - An internal CA, "Isla Internal CA", for internal certificates.
- PCI DSS assessments for the payment chain, run by the payment service provider.
6. Suppliers
List provided by Sharon Doran. "These are the suppliers that matter for IT."
| # | Supplier | Service | Notes from procurement | Contract owner |
|---|---|---|---|---|
| 1 | PayCarib | card processing and tokenisation | Card data is tokenised at PayCarib; the keys sit in their HSM. Largest IT contract. | finance |
| 2 | IdentiQ | single sign-on (SaaS) for staff | Hosts our SSO; issues the SAML assertions our apps trust. | platform |
| 3 | CloudNorth | IaaS hosting for the webshop | Disks and backups are encrypted by CloudNorth with keys they manage. | webteam |
| 4 | Microsoft 365 | mail and office | Standard Microsoft terms. Mail and documents are classified BIV Midden (confidentiality medium). | IT |
| 5 | PrintPost | printing and posting of customer statements | Receives statement files from us over SFTP. Small contract. | finance |
7. Deliverables expected
| # | Deliverable | For |
|---|---|---|
| D1 | Maturity baseline: where Isla stands on cryptography, per domain | CISO, board |
| D2 | Gap analysis against DORA / NIS2 and PQC readiness | CISO, supervisor |
| D3 | Consolidated inventory of cryptographic assets with owners | IT manager |
| D4 | Supplier classification by cryptographic risk, with contract requirements per tier | Procurement lead |
| D5 | Policy draft that follows from the gaps | CISO |
| D6 | Management report and a readout: where we stand, what it costs, what first | CISO, board |
8. Constraints
- Readout to the CISO at the end of the engagement; 5 minutes, no slides beyond one page.
- No production changes during the engagement.
- Findings on live systems are verified before they are reported.