Government cybersecurity
Every incident transition had to stand up to an audit.
I engineered core parts of Germany's regulated incident-reporting platform, where identity, deadlines, encryption, and every state transition carried a security or legal consequence.
Technology
The workflow itself was legal evidence
Germany's NIS2 reporting workflow requires regulated organisations to submit an initial notification within 24 hours, followed by detailed updates and closure. The platform needed to preserve the exact sequence and timing of every action.
It also had to support authenticated organisations and anonymous voluntary reporters without allowing one trust model to weaken the other.
Engineered auditability into the platform
I owned engineering work around workflow integrity, identity, encrypted payload handling, and operational edge cases across the platform.
The engineering standard was shaped by federal infrastructure, formal penetration testing, and the requirement that audit evidence remain tamper-evident.
Architecture
Legal obligations became state-machine invariants
The architecture made deadlines, identities, transitions, and evidence explicit rather than relying on policy around a generic workflow engine.
- 01
Constraint
Updating a mutable status field would lose the legal history of how and when an incident changed state.
Decision
Represent every transition as an append-only event and derive the current state by replaying the event sequence.
Impact
The platform retains a complete record of submissions, analyst actions, reasons, identities, and timestamps.
- 02
Constraint
A two-minute clock error around a 24-hour deadline could change the compliance status of a submission.
Decision
Use monitored server time for audit events and alert on infrastructure clock drift beyond the accepted threshold.
Impact
Deadline evidence is consistent, centralised, and defensible during later review.
- 03
Constraint
Anonymous reports had to remain unlinkable while still entering the national threat-intelligence workflow.
Decision
Separate the anonymous endpoint and data path from authenticated sessions, account stores, and application-level source logging.
Impact
Voluntary reports can contribute useful indicators without inheriting the identity model of mandatory reporting.
- 04
Constraint
Incident payloads could expose active vulnerabilities and mitigation details if infrastructure were compromised.
Decision
Encrypt payloads before submission and keep private-key operations inside controlled federal key-management infrastructure.
Impact
Stored and transmitted report data remains protected beyond the outer TLS connection.
Outcome
A reporting lifecycle designed for evidence, not only submission
- A structured incident lifecycle covering initial notification, detailed reporting, progress updates, and closure.
- Organisation identity and delegated reporting through Keycloak-backed access controls.
- A technically isolated anonymous reporting path.
- A platform designed and remediated against formal penetration-test findings before launch.
This work made one principle concrete: in regulated systems, compliance cannot be a checklist around the product. It has to be encoded in the state model, identity boundaries, timestamps, and failure behaviour.
Abrar
Start a project
Building a regulated workflow where every transition matters?
I can help turn legal, security, and operational obligations into a system that remains inspectable under pressure.
Discuss your regulated platform