GDPR Article 32: the risk-based security obligation shared by controllers and processors, its four named measures, how the appropriate level of security is assessed, and the regulator decisions that show what falls short.
The overall security obligation: risk-based measures weighed against the state of the art and cost, the risks Article 32(2) says to consider, certification as evidence, and recent fines that show what regulators treat as inadequate.
The two named technical measures: the legal meaning of pseudonymization, why pseudonymized data stay personal data, encryption and key separation, and how encryption affects breach communication and transfer risk.
The ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services: access control, authentication, network protection, logging and capacity, and how breach types map to each property.
Backup and recovery capability for personal data after a physical or technical incident: restore objectives, tested restores, and why loss of availability can itself be a notifiable personal data breach.
A process for regularly testing and evaluating whether security measures work: vulnerability scanning, penetration tests, configuration checks, restore tests and audits, and the evidence that the process actually runs.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.