Portfolio

ISO 27001 ISMS – Implementing Information Security Efficiently

ISO/IEC 27001 is the established standard for establishing and operating an Information Security Management System (ISMS).

We help you implement the requirements in a pragmatic way—tailored to your organization and ready for audits in day-to-day operations.

Our Services:

• Gap Analysis according to ISO 27001
• Risk Analysis & Statement of Applicability (SoA)
• Documentation and Guidelines
• Preparation for Certification Audits
• Operation and Further Development of the ISMS
• Optional: Combination with ISB Mandate

Your Benefits:

You efficiently meet ISO 27001 requirements and embed information security sustainably within your organization.

OT environments (ICS, SCADA, DCS, PLC) have specific requirements regarding availability and operational reliability.

We conduct structured, non-invasive OT security audits and assess cyber risks in a practical manner—without disrupting production systems.

Focus of our audit:

• System transparency & asset discovery
• Vulnerability analysis
• Network segmentation & architecture
• Access controls & remote access
• Operational processes & incident response

Methodological approach:

• Based on IEC 62443, ISO 27001, and NIST SP 800-82
• Purdue Model / ISA-95 Architecture
• Passive before active – no disruption to production
• Risk-based rather than purely compliance-driven

Technical Areas of Review:

• Network Segmentation & Zone Model
• Identity & Access Control
• System Hardening & Patch Management
• Industrial Protocols & Communication
• Monitoring & Detection
• Emergency and Incident Processes

Results:

• Technical report with concrete findings
• Prioritized action plan (quick wins & structural improvements)
• Management summary with clear decision-making criteria

Your benefits:

Well-founded transparency, prioritized measures, and a solid foundation for securing your OT environment.

NIS2 Consulting – Implementing Compliance in a Pragmatic Way

We support you in efficiently implementing NIS2 requirements—from analysis through to ongoing operations.

Our Services:

• Gap Analysis & Maturity Assessment
• Establishment of Governance and Compliance Structures
• Risk Management & Security Strategy
• Incident Response & Reporting Processes (24h/72h)
• Supply Chain and Third-Party Risks
• Technical Security Measures & IAM
• Policies, Documentation & ISMS
• Awareness Training & Workshops
• Audit Preparation & Managed NIS2 Services

Your Benefits:

Clear NIS2 compliance, structured implementation, and sustainable cyber resilience.

External DPO Mandate – Implementing Data Protection Efficiently and Practically

Data protection presents many organizations with challenges: complex requirements, high expectations, and limited resources.

With our external DPO mandate, we support you in implementing data protection in a structured, legally compliant, and pragmatic manner—without unnecessary bureaucracy.

Our role:

We provide your organization with continuous and independent support, combining legal requirements with practical implementation and ensuring that data protection works in everyday operations.

Suitable for:

• SMEs without their own data protection department
• Public administrations and municipalities
• Organizations that process large amounts of personal data
• Companies subject to regulatory requirements
• Companies that want to establish a professional data protection framework

Our approach:

• Clear and understandable, not complex
• Practical, not theoretical
• Proportionate, not overregulated

Your benefits:

Greater security, clear processes, and a noticeable reduction in workload—data protection firmly embedded in your organization.

Social Engineering Assessment – The Human Factor in Security Checks

Many cyberattacks begin with social engineering. We conduct realistic tests to determine how vulnerable your organization is to manipulation attempts—in a controlled, secure environment with clearly defined parameters.

Objectives of the assessment:

• Evaluate responses to manipulation attempts
• Identify processes that can be circumvented
• Identify organizational and technical vulnerabilities
• Verify the effectiveness of awareness measures

Typical Scenarios:

• Phishing & Spear Phishing
• Pretexting (impersonation)
• Vishing (telephone attacks)
• Physical social engineering tests (optional)

Methodological Approach:

• Scope definition
• Conducting realistic tests
• Evaluation of results
• Reporting with concrete recommendations

Your Benefits:

• Measurable assessment of your security culture
• Identification of specific vulnerabilities
• Targeted improvement measures
• Greater resilience against attacks
• More effective awareness programs

Our approach:

Responsible execution without exposing individual employees—with a focus on sustainable improvement.

Result:

Clear transparency regarding your resilience against social engineering and concrete steps for optimization.

External ISO – Effectively Managing Information Security

The Information Security Officer (ISO) plays a central role in ensuring effective cybersecurity. By engaging an external ISO, we ensure that your information security is managed in a structured manner and firmly embedded in your day-to-day operations.

Our responsibilities:

• Advising management on information security
• Establishing and further developing the ISMS
• Coordinating security measures
• Monitoring policies and guidelines
• Supporting risk and decision-making processes

Your benefits:

• Clear structures and responsibilities
• Ongoing support
• Transparency regarding risks and progress
• Better preparation for audits and certifications
• Sustainable integration of information security

Suitable for:

• SMEs and public administrations
• Organizations with heightened security requirements
• Companies with ISO 27001 or similar standards

Your advantage: 

More structure, continuity, and effective information security—without additional internal resources.