External CISO

Information Security Officer on demand - from EUR 1,500/month

Your certified CISO - available immediately, independent of internal hierarchies, and at a fraction of the cost of a full-time hire. Including ISMS management, NIS-2 support, and ISO 27001 certification guidance. From EUR 1,500 per month plus VAT.

Request external CISO How it works

ISO 27001 Lead Auditor NIS-2 expertise Available from day 1

Chris Wojzechowski, managing director of AWARE7 GmbH and point of contact for the external CISO service — External CISO / Dedicated contact

Trusted by our clients

EUR per month plus VAT: from 1,500
Substitute cover during holidays and sickness: Team
Lead Auditors in the team: ISO 27001

Service Scope

What your external CISO does

Our external CISOs take on all duties of an internal information security officer - tailored to your organisation size, sector, and regulatory requirements.

No.AreaWhat we do

ISMS Management

Build, maintain, and continuously improve your information security management system per ISO 27001. Documentation, risk management, and policy framework.

NIS-2 Compliance

Applicability analysis, implementation of the 10 mandatory measures, setup of incident reporting processes, and preparation for supervisory reviews.

Risk Management

Regular risk assessments, treatment of identified risks, and escalation reporting to management. Including annual management reviews.

Employee Awareness

Design and delivery of security awareness training. Coordination of phishing simulations and measurement of awareness development.

Incident Management

Assessment and management of security incidents. Coordination of responses, documentation, and reporting to relevant authorities (72-hour notification).

Audit Support

Preparation and support for internal and external audits (ISO 27001, NIS-2, TISAX). Coordination with certification bodies.

External vs. internal

External vs. internal CISO

A qualified internal CISO costs around EUR 100,000 to 142,000 per year including employer contributions, training and workspace, and recruiting takes months. The direct comparison shows why most mid-sized organisations choose the external model.

Criterion	External CISO (AWARE7)	Internal CISO
Monthly cost	from EUR 1,500 plus VAT	EUR 8,000-10,000
Available from	Day 1	3-6 months
Coverage in absence	Team coverage	None
Industry breadth	Multi-sector experience	Single company
Certifications	ISO 27001 Lead Auditor, OSCP	To be organised

Our approach

How the external CISO engagement works

In five phases we take on your information security management - from initial consultation to continuous operations.

StepPhaseWhat happens

01
Initial consultation & needs analysis

Free intake: we clarify your industry context, regulatory requirements (NIS-2, ISO 27001, critical infrastructure), and the current state of your information security. You receive an initial assessment and a tailored proposal.
02
Onboarding & current-state assessment

Systematic analysis of your IT landscape, existing documentation, and organisational structures. Identification of quick wins and critical gaps. You have a dedicated point of contact from day one.
03
ISMS build-out or enhancement

Development or optimisation of your information security management system: risk assessment, security policy, guidelines, and procedures - scaled to your organisation size and sector.
04
Operational management

Your CISO in ongoing operations: assess security incidents, coordinate measures, raise staff awareness, produce regular status reports to management.
05
Continuous improvement

Annual management review, adaptation to new threat landscapes and regulatory changes. Audit preparation and support for internal and external reviews.

Why AWARE7 as your external CISO

What sets us apart from other providers

Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.

Research and teaching as our foundation

20 %

Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.

Digital sovereignty: no compromises

100 %

From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.

Fixed price within 24h: predictable project timelines

24 h

Within 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.

Your dedicated contact

1:1

A personal project manager accompanies you from the first meeting through implementation. You book appointments directly with your contact person and keep the same contact throughout the project.

Peer-reviewed publications

Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations

ACM AsiaCCS 2025

Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

A Platform for Physiological and Behavioral Security

NSPW 2025

Jan Hörnemann

Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem

IEEE/IFIP DSN 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Understanding Regional Filter Lists: Efficacy and Impact

PoPETS 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Who is AWARE7 the right partner for?

Mid-sized companies with 50-2,000 employees

Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.

IT managers & CISOs

Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.

Regulated industries

Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.

Your external CISOs

ISO 27001 Lead Auditors with many years of ISMS experience - available from day one.

Chris Wojzechowski

Managing Director

E-Mail

PGP 465C26E1AF161AFA

Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.

IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK) T.I.S.P. Board-Mitglied

View full profile

Jan Hörnemann

COO

E-Mail

PGP A3FD64BB96C888E2

M.Sc. in Internet Security (if(is), Westfälische Hochschule). COO and authorized officer (Prokurist) with expertise in information security consulting and security awareness. Junior professor (Nachwuchsprofessur) for Cyber Security at FOM Hochschule, CISO lecturer at isits AG and doctoral candidate at the Graduierteninstitut NRW.

ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)

View full profile

References

Reference from our ISMS consulting

These case studies are available in German.

01 Security Consulting brainbits GmbH Read case study (German)

Pricing

What the external CISO costs

No off-the-shelf packages: scope, cadence and terms are agreed in the initial consultation, matched to your organisation size, maturity and regulatory requirements.

Starting at: EUR 1,500 / month; plus VAT
Scope: agreed with you; Days per month, reporting cadence and on-site share follow your needs.
Next step: Free consultation; Request an individual quote

Frequently asked questions about the external CISO

Questions about the engagement model, costs, or collaboration? Find answers here.

What does an Information Security Officer (CISO) do?

The CISO is the central point of contact for all information security matters in your organisation. They develop and maintain the ISMS, advise management, coordinate security measures, train employees, and report regularly on the security status. As the interface between IT, management, and staff, they ensure information security does not remain a siloed topic.

Why choose an external CISO instead of an internal hire?

An external CISO brings immediately deployable expertise, is independent of internal hierarchies, and costs a fraction of a full-time role. While a qualified internal CISO (including employer costs, training, and workspace) costs around EUR 100,000 to 142,000 per year, an external CISO is available from approximately EUR 1,500 per month. Additionally: they bring experience from many industries and organisations and are free from organisational blind spots.

Do we actually need a CISO?

For organisations subject to NIS-2, a designated information security officer is advisable. ISO 27001 also requires assigned responsibilities and authorities for information security. Moreover, many clients (particularly in the automotive industry, financial sector, and among critical infrastructure operators) and cyber insurers require a designated CISO. Even without a legal obligation, a CISO is the most structured solution for sustainable security management.

How much time does an external CISO invest?

That depends on your organisation size, the maturity of your ISMS, and your regulatory requirements. Typical for an SME with 50-200 employees: 2-4 days per month. During the ISMS build-out phase or in preparation for certification, the effort may temporarily be higher. We scale the scope to your actual needs.

What does an external CISO cost?

Our external CISO is available from EUR 1,500 per month plus VAT. There are no fixed packages: days per month, reporting cadence and on-site share are agreed in the initial consultation. The exact price depends on organisation size, scope, and the desired service level. For comparison: an internal full-time role costs at least EUR 100,000 per year including employer contributions and training. With an external CISO you also avoid recruitment costs, onboarding time, and the risk of staff absence.

How does day-to-day collaboration work?

Your external CISO is available by email, phone, and video conference. On-site appointments are arranged as needed and ensure personal contact. You have a dedicated point of contact who knows your organisation and provides long-term support. During security incidents we coordinate the necessary immediate measures and reporting obligations.

Can the external CISO also support with NIS-2?

Yes, NIS-2 implementation is a core area of our CISO activities. We support with applicability analysis, building the required security measures, implementing incident reporting processes, and preparing for supervisory reviews. Our CISO service covers all NIS-2 requirements on security management.

What happens if our CISO is sick or on holiday?

Unlike an internal CISO, there is no single-person risk with us. There is always a qualified substitute in the AWARE7 team who knows your organisation and its structures. This is one of the major advantages of the external model over a single internal role.

Can we switch to an internal CISO later?

Of course. We actively support the transition: knowledge transfer, documentation handover, and optional coaching of your new internal CISO are part of our service scope. Many clients start externally and build internal competence in parallel. Some also use a hybrid model where an internal coordinator is complemented by our external expertise.

Aus dem Blog