Information Security Consulting

Duration depends on organisational size and starting maturity. For a mid-sized organisation (50-500 employees) we realistically expect 9-18 months from kick-off to certification. Organisations with existing processes can achieve certification in 6-9 months. We always start with a gap analysis that delivers a clear timeline and resource requirements within 4 weeks.

Investment varies significantly by scope and starting position. An initial gap analysis typically costs EUR 3,000-6,000. A complete ISMS implementation including certification support starts from approximately EUR 15,000 depending on organisational size. In the free initial consultation you receive an initial estimate - a binding fixed-price quote follows within 24 hours, with no hourly-rate risk.

An external CISO takes on all duties of an internal Information Security Officer - without the costs of a full-time hire (typically EUR 80,000-120,000/year including employer costs). They are immediately available, hold ISO 27001 Lead Auditor certifications, and carry contractual liability. Particularly beneficial for organisations that cannot find a suitable internal candidate, need to act quickly, or require the function on a time-limited basis.

NIS-2 applies to "important" and "essential" entities with 50+ employees or EUR 10 million annual turnover in 18 defined sectors (including energy, transport, healthcare, digital infrastructure, manufacturing). Obligations include risk management measures, incident reporting (24h initial notification), supply chain security measures, and personal liability for management. Our applicability assessment clarifies in 2 hours whether and to what extent NIS-2 applies to you.

The CyberRisikoCheck is an analysis instrument developed by the BSI specifically for small and medium-sized enterprises. It reviews 27 requirements across 6 action areas (organisation, identity and access management, data backup, malware protection, patch management, incident response). The result is a concrete implementation plan with prioritised measures. Particularly suitable as an entry point for organisations without an existing ISMS or as preparation for supplier audits.

Yes. Many of our clients use us as a long-term advisory partner: for annual internal audits, surveillance audits, recertification after 3 years, management reviews, and continuous ISMS development. On request we also take on the role of external CISO and ensure your ISMS keeps pace with new requirements (new ISO versions, NIS-2, DORA).