External CISO

Information Security Officer on demand - from EUR 1,500/month

Your certified CISO - available immediately, independent of internal hierarchies, and at a fraction of the cost of a full-time hire. Including ISMS management, NIS-2 support, and ISO 27001 certification guidance.

Request external CISO How it works

ISO 27001 Lead Auditor NIS-2 certified Available from day 1

External vs. internal CISO

Monthly cost from EUR 1,500 EUR 8,000-10,000

Available from Day 1 3-6 months

Coverage in absence Team coverage None

Industry breadth Multi-sector experience Single company

Certifications ISO 27001, NIS-2, OSCP To be organised

Termination notice 1-3 months 3-6 months

Trusted by over 200 organisations

External CISO mandates: 50+; External CISO mandates
EUR/month from: 1,500; EUR/month from
Years of experience: 10+; Years of experience
Response time SLA: 24h; Response time SLA

Service Scope

What your external CISO does

Our external CISOs take on all duties of an internal information security officer - tailored to your organisation size, sector, and regulatory requirements.

ISMS Management

Build, maintain, and continuously improve your information security management system per ISO 27001. Documentation, risk management, and policy framework.

NIS-2 Compliance

Applicability analysis, implementation of the 10 mandatory measures, setup of incident reporting processes, and preparation for supervisory reviews.

Risk Management

Regular risk assessments, treatment of identified risks, and escalation reporting to management. Including annual management reviews.

Employee Awareness

Design and delivery of security awareness training. Coordination of phishing simulations and measurement of awareness development.

Incident Management

Assessment and management of security incidents. Coordination of responses, documentation, and reporting to relevant authorities (72-hour notification).

Audit Support

Preparation and support for internal and external audits (ISO 27001, NIS-2, TISAX). Coordination with certification bodies.

Our approach

How the external CISO engagement works

In five phases we take on your information security management - from initial consultation to continuous operations.

Why AWARE7 as your external CISO

What sets us apart from other providers

Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.

Research and teaching as our foundation

20 %

Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.

Digital sovereignty: no compromises

100 %

All data is stored and processed exclusively in Germany, without US cloud providers. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.

Fixed price within 24h: predictable project timelines

24 h

Within 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.

Your dedicated contact

1:1

A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.

Peer-reviewed publications

Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations

ACM AsiaCCS 2025

Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

A Platform for Physiological and Behavioral Security

NSPW 2025

Jan Hörnemann

Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem

IEEE/IFIP DSN 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Understanding Regional Filter Lists: Efficacy and Impact

PoPETS 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Who is AWARE7 the right partner for?

Mid-sized companies with 50-2,000 employees

Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.

IT managers & CISOs

Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.

Regulated industries

Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.

Your external CISOs

ISO 27001 Lead Auditors, NIS-2 certified, with over 10 years of ISMS experience - available from day one.

Chris Wojzechowski

Managing Director

E-Mail

PGP 465C26E1AF161AFA

Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.

IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK) T.I.S.P. Board-Mitglied

Vollständiges Profil ansehen

Jan Hörnemann

COO

E-Mail

PGP A3FD64BB96C888E2

M.Sc. in Internet Security (if(is), Westfälische Hochschule). COO and authorized officer (Prokurist) with expertise in information security consulting and security awareness. Junior professor (Nachwuchsprofessur) for Cyber Security at FOM Hochschule, CISO lecturer at isits AG and doctoral candidate at the Graduierteninstitut NRW.

ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)

Vollständiges Profil ansehen

References

External CISO success stories

These case studies are available in German.

01Beratung Informationssicherheitbrainbits GmbHAusbau und Begleitung des ISMS zur ISO 27001 Zertifizierung9Monate bis zur Zertifizierungsreife70Mitarbeitende im TeamRead case study 02Pentesting & SchwachstellenscansInstitut für Verwaltungswissenschaften gGmbHExterne SchwachstellenanalyseRead case study

Transparent pricing

Fixed monthly fees instead of unpredictable hourly rates. Scale as needed.

Essentials

from EUR 1,500 /month

For SMEs with 10-50 employees

2 days/month
ISMS maintenance
Security incident support
Quarterly management report
NIS-2 applicability check

Request quote

Professional

from EUR 2,500 /month

For mid-sized organisations with 50-200 employees

4 days/month
All Essentials features
ISO 27001 certification support
Awareness training
Monthly management report
Priority SLA 4h

Request quote

Enterprise

On request

For organisations with >200 employees or critical infrastructure

Flexible days/month
All Professional features
On-site presence
NIS-2/KRITIS full support
Board reporting
24/7 incident hotline

Request quote

Frequently asked questions about the external CISO

Questions about the engagement model, costs, or collaboration? Find answers here.

What does an Information Security Officer (CISO) do?

The CISO is the central point of contact for all information security matters in your organisation. They develop and maintain the ISMS, advise management, coordinate security measures, train employees, and report regularly on the security status. As the interface between IT, management, and staff, they ensure information security does not remain a siloed topic.

Why choose an external CISO instead of an internal hire?

An external CISO brings immediately deployable expertise, is independent of internal hierarchies, and costs a fraction of a full-time role. While a qualified internal CISO (including employer costs, training, and workspace) costs at least EUR 100,000-120,000 per year, an external CISO is available from approximately EUR 1,500 per month. Additionally: they bring experience from many industries and organisations and are free from organisational blind spots.

Do we actually need a CISO?

For organisations subject to NIS-2, an information security officer is practically mandatory. ISO 27001 also requires a named responsible person. Moreover, many clients (particularly in the automotive industry, financial sector, and among critical infrastructure operators) and cyber insurers require a designated CISO. Even without a legal obligation, a CISO is the most structured solution for sustainable security management.

How much time does an external CISO invest?

That depends on your organisation size, the maturity of your ISMS, and your regulatory requirements. Typical for an SME with 50-200 employees: 2-4 days per month. During the ISMS build-out phase or in preparation for certification, the effort may temporarily be higher. We scale the scope flexibly - without a long-term commitment to a fixed volume.

What does an external CISO cost?

Our external CISO is available from EUR 1,500 per month. The exact price depends on organisation size, scope, and the desired service level. For comparison: an internal full-time role costs at least EUR 100,000 per year including employer contributions and training. With an external CISO you also avoid recruitment costs, onboarding time, and the risk of staff absence.

How does day-to-day collaboration work?

Your external CISO is available by email, phone, and video conference - typically with a response time of a few hours. Regular on-site appointments (monthly or quarterly) ensure personal contact. You have a dedicated point of contact who knows your organisation and provides long-term support. During security incidents we are also available outside agreed hours.

Can the external CISO also support with NIS-2?

Yes, NIS-2 implementation is a core area of our CISO activities. We support with applicability analysis, building the required security measures, implementing incident reporting processes, and preparing for supervisory reviews. Our CISO service covers all NIS-2 requirements on security management.

What happens if our CISO is sick or on holiday?

Unlike an internal CISO, there is no single-person risk with us. There is always a qualified substitute in the AWARE7 team who knows your organisation and its structures. For critical incidents, availability is guaranteed even during holiday periods. This is one of the major advantages of the external model over a single internal role.

Can we switch to an internal CISO later?

Of course. We actively support the transition: knowledge transfer, documentation handover, and optional coaching of your new internal CISO are part of our service scope. Many clients start externally and build internal competence in parallel. Some also use a hybrid model where an internal coordinator is complemented by our external expertise.

Aus dem Blog