Expertise
Cybersecurity, information security and compliance – as one connected whole.
From the initial assessment through the management system to continuing accountability in operations. Our areas of expertise are built so that each one supports the next.
A system, not a list of individual measures
Security measures rarely fail on technical grounds. They fail because nobody owns them, because priorities are missing, or because evidence is never recorded. So we do not start with tools. We start with an overview: which risks are real, which requirements apply, what is proportionate?
That produces a sequence. The sequence determines which areas of expertise are engaged, and to what extent – as an individual service or as a role we take on permanently.
Areas of expertise
What we take on.
Managed security
Continuous monitoring and vulnerability management instead of point-in-time checks. Findings are assessed, prioritised and tracked through to remediation.
- Vulnerability identification and assessment
- Monitoring and evaluation of security events
- Prioritised recommendations with follow-up
- Reporting for management and IT
Managed CISO (vCISO)
The information security officer role – scalable from a baseline function to full CISO accountability, including representation in audits and towards authorities.
- Establishing and maintaining an ISMS to ISO 27001
- Continuous risk management with KPIs and reporting
- Security policies and awareness programme
- Support through to certification readiness
Information security & ISMS
A management system that works in practice: defined ownership, traceable decisions and documented effectiveness.
- Gap analysis against ISO 27001, NIS2 and TISAX
- Scope definition, policies and processes
- Internal audits and audit simulations
- Effectiveness review and continuous improvement
Governance, risk & compliance
Risks, policies, suppliers and continuity planning as one connected system – rather than separate collections of documents.
- Risk analysis and risk treatment
- Supplier and third-party management
- Emergency management and business continuity
- Policy and evidence management
Data protection & GDPR
The external data protection officer function together with the operational implementation of GDPR obligations – legally sound and practically documented.
- External data protection officer function
- Records of processing activities
- Technical and organisational measures
- Data processing agreements, deletion concept, breach reporting
Audits, assessments & awareness
A reliable baseline assessment, and preparation for the people who have to carry security day to day.
- Gap and maturity assessment
- Internal audits and audit preparation
- Awareness programmes for employees
- Evidence documentation for customers and insurers
Frameworks
The requirements you will be measured against.
We work with the frameworks that actually become relevant in the mid-market – and we state clearly which of them apply to your organisation and which do not.
ISO/IEC 27001
The standard for information security management systems. We support the journey from gap analysis through implementation to certification readiness.
NIS2
Extended requirements for risk management, reporting channels and management accountability. We establish whether you are in scope and derive the necessary measures.
GDPR
Accountability as an ongoing duty: records of processing, data subject rights, processor management, and breach notification deadlines.
TISAX
Sector requirements from the automotive supply chain. Gap analyses and preparation for the assessment.
Approach
Four steps that build on one another.
Assessment
Clarify the starting position, the scope and the requirements that genuinely apply. Outcome: a shared, evidenced view of the status quo.
Gap analysis
Comparison against the relevant framework. Outcome: named gaps, rated by risk and effort.
Roadmap
Measures with priority, ownership and deadline. Outcome: a plan that fits the organisation and is ready for a decision.
Ongoing support
Implementation, effectiveness review, reporting and evidence maintenance. Outcome: a state that still holds up at the next audit.
Delivery
Delivered by ITSB Deutschland.
Consulting and managed services are delivered by ITSB Deutschland. You will find the full service descriptions, package tiers and the option to book an initial conversation there.
Where do you stand today?
If you are not certain which requirements apply to your organisation, that is a good starting point for a conversation – not an obstacle to one.