NIS-2 deadline pressure
NIS-2 implementation obligations are in force. Affected organisations risk fines of up to EUR 10 million - and personal liability for management.
Security Consulting
Information Security Consulting
Structured ISMS design - from gap analysis through ISO 27001 and NIS-2 to successful certification. For CISOs and management teams who leave nothing to chance.
- ISO 27001 Lead Auditors
- All projects successfully certified
- Fixed-price quote in 24h
Trusted by our clients
- 20+
- ISMS projects
- ISO 27001
- Certified
- 20+
- successful certifications
- 24h
- Initial response
The Challenge
Why compliance programmes stall
NIS-2, ISO 27001, DORA - regulatory requirements are growing faster than internal capacity. Four root causes explain why well-intentioned compliance projects run into trouble.
Talent shortage
Qualified security officers are hard to find and expensive to hire. Internal expertise rarely suffices for a complete ISO 27001 implementation.
Audit pressure
Supplier audits, regulatory requests, and customer requirements demand demonstrable security measures - often with only weeks of lead time.
Regulatory complexity
ISO 27001, NIS-2, DORA, GDPR - requirements overlap and are difficult to prioritise without dedicated compliance expertise.
AWARE7 takes full responsibility for consulting and implementation - from the initial applicability assessment through to demonstrable compliance. You get a dedicated point of contact, clear milestones, and a fixed-price quote in 24 hours.
Consulting Services
Five specialised service areas - coordinated for organisations that want to build information security in a structured and demonstrable way.
ISMS Consulting
Design and certification of your Information Security Management System per ISO 27001 - from gap analysis to successful certification.
Leistung entdecken
Internal Audit
Independent review of your security architecture and ISMS conformance by experienced ISO 27001 Lead Auditors - ahead of the external certification audit.
Leistung entdecken
External CISO
Your Information Security Officer on demand - multiply certified, immediately available, and without recruitment or training costs.
Leistung entdecken
NIS-2 Directive
Assess applicability and implement all NIS-2 requirements in a structured way - ahead of the next BSI audit or supplier audit.
Leistung entdecken
BSI CyberRisikoCheck
Structured assessment of your security posture per the official BSI CyberRisikoCheck - with prioritised recommendations.
Leistung entdecken
Your points of contact
Speak directly with our certified security consultants. Free initial consultation - no commitment, strictly confidential.
Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.
IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK) T.I.S.P. Board-Mitglied
M.Sc. in Internet Security (if(is), Westfälische Hochschule). COO and authorized officer (Prokurist) with expertise in information security consulting and security awareness. Junior professor (Nachwuchsprofessur) for Cyber Security at FOM Hochschule, CISO lecturer at isits AG and doctoral candidate at the Graduierteninstitut NRW.
ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)
Our approach
From initial consultation to certification
In five structured phases we build your ISMS and guide you to successful certification.
StepPhaseWhat happens
- 01
Free initial consultation
In a 30-minute call we analyse your current situation, regulatory requirements, and objectives. You receive an initial assessment and actionable recommendations - no commitment, no charge.
- 02
Gap analysis & roadmap
Systematic assessment of your security posture against ISO 27001, NIS-2, or other applicable frameworks. Deliverable: a prioritised action plan with clear milestones and a fixed-price quote.
- 03
ISMS design & implementation
We build your ISMS together: security policy, risk assessment, controls, policies, and procedures. Pragmatic and scaled to your organisation.
- 04
Internal audit & remediation
Independent review of your ISMS by our Lead Auditors. Identification of gaps and support in resolving them - before the external auditor arrives.
- 05
Certification & ongoing operations
Guidance through the certification audit and transition to steady-state operations. On request, we act as your external CISO for long-term ISMS management.
Where does your information security stand today?
In a free 30-minute call we analyse your current situation and show which steps make sense and are achievable for your organisation.
Free · 30 minutes · No obligation
Comparison
AWARE7 vs. alternatives
An honest comparison - so you can make the right decision for your organisation.
| Criterion | AWARE7 | Freelancer | Big-4 Firm |
|---|---|---|---|
| Pricing model | Fixed price in 24h | Hourly rate | Daily rate (high) |
| Cover | Team, always covered | Single-person risk | Rotating consultants |
| Technical testing | Pentesting under one roof | Usually advisory only | Subcontractors |
| SME focus | Core target segment | Mixed | Enterprise focus |
| Response time | 24 hours | Variable | Days to weeks |
| Ongoing CISO | Yes, from EUR 1,500/mo | Possible | Rarely / very expensive |
Why AWARE7 as your consulting partner
What sets us apart from other providers
Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.
Research and teaching as our foundation
20 %Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.
Digital sovereignty: no compromises
100 %From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.
More on digital sovereigntyFixed price within 24h: predictable project timelines
24 hWithin 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.
Your dedicated contact
1:1A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.
Peer-reviewed publications
Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations
ACM AsiaCCS 2025
Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
A Platform for Physiological and Behavioral Security
NSPW 2025
Jan Hörnemann
Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem
IEEE/IFIP DSN 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Understanding Regional Filter Lists: Efficacy and Impact
PoPETS 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Who is AWARE7 the right partner for?
- Mid-sized companies with 50-2,000 employees
- Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.
- IT managers & CISOs
- Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.
- Regulated industries
- Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.
References
Successful consulting projects
These case studies are available in German.
Target groups
Who we work with
Mid-sized organisations
50-500 employees looking to build an ISMS or professionalise their existing security organisation.
NIS-2 affected entities
Organisations in the 18 NIS-2 sectors that want to build compliance in a structured way and avoid regulatory fines.
Critical infrastructure operators
Operators with mandatory evidence requirements under applicable critical infrastructure legislation.
Organisations seeking ISO 27001 certification
From gap analysis through ISMS design to successful certification - everything under one roof.
Suppliers and service providers
Organisations whose customers require security evidence: TISAX, ISO 27001, supplier audits.
Growing start-ups
Young organisations that want to build security structures early - for enterprise customers or investors.
Qualifications
Our qualifications
ISO 27001
Lead Auditor
T.I.S.P.
Certified
BSI
IT-Grundschutz Experts
OSCP
Offensive Security
AZAV
Certified Training Provider
Further services
Complementary services
Penetration Testing
Technical security assessment of your systems and applications. The ideal complement to organisational consulting.
Request pentestPhishing Simulation
Test the awareness of your employees with realistic phishing campaigns. Measurable, traceable, repeatable.
Learn about phishing simulationSME Security Analysis
Comprehensive security analysis for SMEs: external, internal, and as a workshop. The pragmatic entry point to information security.
Request analysisFAQ
Questions about security consulting
Answers to the most important questions about ISMS design, ISO 27001 certification, external CISO, and NIS-2 compliance.
How long does it take to build an ISMS per ISO 27001?
Duration depends on organisational size and starting maturity. For a mid-sized organisation (50-500 employees) we realistically expect 9-18 months from kick-off to certification. Organisations with existing processes can achieve certification in 6-9 months. We always start with a gap analysis that delivers a clear timeline and resource requirements within 4 weeks.
What does ISO 27001 consulting cost?
Investment varies significantly by scope and starting position. An initial gap analysis typically costs EUR 3,000-6,000. A complete ISMS implementation including certification support starts from approximately EUR 15,000 depending on organisational size. In the free initial consultation you receive an initial estimate - a binding fixed-price quote follows within 24 hours, with no hourly-rate risk.
What is an external CISO and when does it make sense?
An external CISO takes on all duties of an internal Information Security Officer - without the costs of a full-time hire (typically EUR 80,000-120,000/year including employer costs). They are immediately available, hold ISO 27001 Lead Auditor certifications, and carry contractual liability. Particularly beneficial for organisations that cannot find a suitable internal candidate, need to act quickly, or require the function on a time-limited basis.
Are we subject to NIS-2 and what do we specifically need to implement?
NIS-2 applies to "important" and "essential" entities with 50+ employees or EUR 10 million annual turnover in 18 defined sectors (including energy, transport, healthcare, digital infrastructure, manufacturing). Obligations include risk management measures, incident reporting (24h initial notification), supply chain security measures, and personal liability for management. Our applicability assessment clarifies in 2 hours whether and to what extent NIS-2 applies to you.
What is the BSI CyberRisikoCheck and who is it for?
The CyberRisikoCheck is an analysis instrument developed by the BSI specifically for small and medium-sized enterprises. It reviews 27 requirements across 6 action areas (organisation, identity and access management, data backup, malware protection, patch management, incident response). The result is a concrete implementation plan with prioritised measures. Particularly suitable as an entry point for organisations without an existing ISMS or as preparation for supplier audits.
Do you support us after ISO 27001 certification?
Yes. Many of our clients use us as a long-term advisory partner: for annual internal audits, surveillance audits, recertification after 3 years, management reviews, and continuous ISMS development. On request we also take on the role of external CISO and ensure your ISMS keeps pace with new requirements (new ISO versions, NIS-2, DORA).
Aus dem Blog
Weiterführende Artikel
Weiterbildung & Zertifizierung
5 Gründe warum ein IT-Security E-Learning vor Cyberattacken schützt!
Ein IT-Security E-Learning kann in Unternehmen zum Schutz vor erfolgreichen Cyberattacken eingesetzt werden. Das sind die Gründe!
Jan Hörnemann Weiterlesen
Offensive Security
9 Hacking Gadgets 2025: Lernen und Forschen
Entdecke 9 Hacking Gadgets und erfahre, wie du sie sicher, legal und verantwortungsvoll nutzt, um IT-Sicherheit wirklich zu verstehen.
Vincent Heinen Weiterlesen
Security Awareness
8 WeTransfer-Alternativen vorgestellt!
WeTransfer speichert teils Daten auf Servern in den USA. Das birgt Risiken und ruft WeTransfer-Alternativen auf den Plan.
Chris Wojzechowski Weiterlesen
Compliance doesn't have to be complicated.
20+ organisations have built and successfully certified their ISMS with AWARE7. Your fixed-price quote is ready within 24 hours.
Free · 30 minutes · No obligation
