Cybersecurity for Business: When You Need a Dedicated Specialist and What to Do in Case of a Data Breach

Asylbek Adilsary, city — Almaty, expert at Freedom Cloud Holding’s Cyber Monitoring Center

An online store stores customers’ contact details and addresses, a clinic keeps medical records, and a small company stores documents, calculations, and correspondence in cloud services. Business sizes may vary, but the consequences of digital incidents are often the same: operational downtime, financial losses, and decreased customer trust.

At the same time, not every company needs a dedicated cybersecurity specialist from day one. In the early stages, some tasks can be outsourced to an external expert or contractor. However, if a business stores large volumes of personal data, launches digital products, and regularly grants partners access to its systems, managing risks on an ad hoc basis will no longer suffice.

Why cybersecurity concerns more than just IT

A cloud service outage can halt the entire team’s work. Altering payment details leads to direct financial losses, while publishing a customer database affects reputation and partner relationships.

Kazakhstani cases illustrate the scale of the risk. In 2024, the State Technical Service discovered personal data of more than two million Zaimer.kz microfinance clients in open sources. In 2025, a database containing approximately 16 million records about Kazakhstani citizens appeared online.

After such an incident, a company must not only restore its systems. It needs to determine the scale of the breach, interact with regulators, answer customers’ questions, and explain the situation to partners. Therefore, cybersecurity is not just about IT tools but also a separate business process.

How to know when a company needs to assign this role

There is no single criterion based on the number of employees or revenue size. A small medical service may process more sensitive data than a large company that hardly handles personal information.

What matters is not the organization’s size but the volume and nature of digital risks. It is time to reassess the protection approach if the business:

— stores personal, medical, or payment data

— launches a website, mobile app, or personal account

— grants contractors access to internal systems

— uses multiple cloud platforms

— operates through several offices or a distributed team

— depends on uninterrupted operation of a digital service

— regularly undergoes partner audits

— signs contracts with information security requirements.

Another warning sign is the absence of a responsible person. No one systematically checks updates, backups, and access rights; former employees retain access to the cloud; incidents are investigated only after a customer complaint.

In other words, the decision depends not on the number of laptops but on the volume and continuity of tasks.

In-house employee or external expert

Small businesses do not necessarily need to create a full-fledged information security department right away. At the start, you can hire an external specialist on a part-time basis, use contractor services, or appoint an internal coordinator.

This model is suitable for initial audits, implementing basic security measures, developing policies, and regularly verifying their compliance.

An in-house specialist is needed when security becomes part of daily operations and product development: the company constantly releases updates, integrates with partners, processes large volumes of personal data, or must respond quickly to incidents.

It is important not to confuse a cybersecurity specialist with a system administrator. A system administrator is responsible for infrastructure operation, while a security specialist focuses on risk assessment, security verification, and control over policy compliance.

What a specialist does in practice

The first task is inventory: it is necessary to determine where important data is stored, who has access to it, and which services are critical for operations. Customer data may simultaneously reside in a CRM system, email, cloud storage, accounting software, and even a spreadsheet on a manager’s personal laptop.

After inventory, basic security measures are implemented together with the IT team:

— multi-factor authentication

— timely installation of updates

— restriction of excessive permissions

— backup and recovery testing

— revoking access for terminated employees

— monitoring suspicious activity

— incident response plan.

The human factor

According to the Verizon Data Breach Investigations Report 2026, the human factor was present in 62% of reviewed data breaches. This does not mean that employees were insufficiently trained in all cases. However, phishing, accidental file sharing, and credential sharing remain serious risks.

Therefore, it is important to explain not only general rules but also specific actions to employees: how to verify a request to change payment details, recognize a fake login page, report a suspicious email, and know what to do after accidentally clicking a link.

At the same time, responsibility cannot be shifted entirely to users. Even a careful employee might open a well-crafted phishing email. Training should complement technical protection, not replace it.

In the same Verizon study, vulnerability exploitation became the most common initial attack vector, featured in 31% of breaches. Therefore, timely updates, restricting external access, and infrastructure monitoring remain just as important as staff training.

What the law requires

Starting August 25, 2026, Kazakhstan’s Labor Code obliges employees to comply with cybersecurity requirements and employers to familiarize staff with relevant internal regulations and monitor their implementation.

Starting September 21, 2026, upon discovering a personal data breach, a company must notify the authorized body within one working day. The notification must also include the contact details of the employee responsible for data processing.

Such a short timeframe leaves little room for improvisation. Therefore, responsible persons, incident documentation procedures, scale assessment, and regulator interaction protocols must be defined in advance.

However, the law does not require every employer to hire a dedicated cybersecurity specialist. Businesses can choose the most suitable model: an in-house employee, an external expert, or a contractor. The key is that responsibility is clearly assigned and the process works in practice.

What to do if an incident has already occurred

When a breach is detected, the first hours are more critical than having a perfect plan. It is necessary to quickly establish known facts and limit further data exposure.

Basic algorithm:

1. Record the time and circumstances of the incident.

2. Identify affected systems and data categories.

3. Isolate infected or compromised devices.

4. Change passwords and revoke active sessions.

5. Block unnecessary and suspicious access.

6. Preserve event logs and other evidence.

7. Prepare a notification for the authorized body.

8. Assign a responsible person for communication with customers and partners.

Avoid immediately deleting files, reinstalling systems, or clearing logs: this may destroy information needed for investigation.

The specialist’s task at this stage is not to find the culprit but to separate confirmed facts from assumptions, stop the incident’s progression, and help the company meet its obligations within the required timeframe.

Does a business need a specialist?

There is no universal answer. A small company may suffice with an external expert and a responsible coordinator. A growing digital service with complex infrastructure and large volumes of customer data will likely require a dedicated employee or team.