Company
Information security is not a project. It is a leadership responsibility.
ITSB Group is the umbrella brand under which we bring together consulting, managed services and our own software for information security, data protection and compliance.
Why ITSB exists
Mid-sized companies face an uncomfortable position when it comes to information security. The requirements are the same as those placed on large corporations – by regulation, by supply chains, by insurers and customers. The resources are not. A dedicated security team, a compliance function, a permanently staffed CISO role: at this scale, that is rarely realistic.
The usual answers fall short. An assessment describes the situation but does not change it. A tool produces data but not decisions. A certificate proves a point in time, not an operating practice.
ITSB addresses that gap. We take on professional accountability where it cannot be filled internally, and we use our own software to make the consequences traceable – for the management, for auditors, and for the day something goes wrong.
Purpose
What we have set out to do.
Purpose
We make cyber risk visible to decision-makers, reduce liability exposure, and implement security measures in a way that survives everyday operations.
Mission
Information security, data protection and compliance should become governable for mid-sized companies – through clear priorities, assigned ownership and reliable documentation, instead of binders and isolated measures.
Standard
Consulting and software belong together. What we advise has to be documentable; what our software represents has to come from consulting practice. That interplay is the core of ITSB Group.
Principles
Four principles that govern our work.
Comprehensibility before completeness
A security report the management cannot understand has missed its purpose. We translate technical findings into decisions – with priorities, effort and consequence.
Accountability, not just activity
We take on roles, not only tasks: external data protection officer, information security officer, point of contact during an audit. Accountability cannot be handed over in a slide deck.
Demonstrability
Measures without evidence are, in case of doubt, considered absent – by supervisory authorities, insurers and customers alike. With us, evidence accumulates continuously as work is done.
Proportionality
Security has to fit the organisation. We do not recommend measures a company cannot sustain organisationally – not even when they would be easy to sell.
Structure
How ITSB Group is organised.
ITSB Group is the shared brand for two areas of work: ITSB Deutschland is responsible for consulting and managed services, while ITSB-OS is our software platform for security and compliance management.
The two are deliberately interlocked. What we observe in audits, risk analyses and data protection engagements shapes the platform. Conversely, our consultants work in the same software our clients and partners use.
We are based in Munich. We work wherever our clients are – predominantly in the German-speaking mid-market, increasingly within internationally connected supply chains where security evidence has to be provided in English as well.
A note on brand structure: “ITSB Group” is an umbrella brand of ITSB Deutschland UG (haftungsbeschränkt) and does not denote a legally independent holding company. “ITSB-OS” is a product brand of the same company, not a separate legal entity.
Accountable
People, not role descriptions.
Anyone who takes on responsibility for information security should be reachable. At ITSB, you know who you are working with.
René Eck
Founder & Managing Director
Responsible for consulting, product development and the management of ITSB Deutschland UG. Focus areas: information security, data protection and process management in the mid-market. “IT security is not a project. It is a leadership responsibility.”
Andreas Pflieger
Partner – Attorney specialising in IT law and data protection
Supports engagements at the intersection of law and technology: data protection law, contract design and the legal assessment of security incidents.
Network
Memberships and affiliations.
Professional ties to institutions and networks that set standards and enable exchange:
- Alliance for Cyber Security (participant, German Federal Office for Information Security – BSI)
- Chamber of Commerce and Industry for Munich and Upper Bavaria (IHK)
- Cybersicherheitsnetzwerk (German cyber security network)
- BVMW – German Association for Small and Medium-Sized Businesses (member company)
- BvD e. V. – German Association of Data Protection Officers
Memberships and network affiliations are not certifications or audit marks. They evidence professional affiliation, not the conformity of a management system.
Get to know us.
A first conversation commits you to nothing and usually clarifies more than a proposal document: where you stand, what is actually required, and what the next sensible step would be.