IT Security Consulting

Services overview

• Strategic security consulting: Analysis of your security posture, identification of risks, and development of a security strategy. I consider technical, organizational, and human factors, because security incidents often arise from process gaps and lack of awareness, not technical weaknesses alone.
• NIS2 compliance: Assessment of whether your organization falls under the NIS2 directive, gap analysis of existing measures, and development of a concrete action plan. The NIS2 implementation law affects significantly more organizations than the previous NIS directive, including many mid-sized companies in the sectors it covers. Many of them do not know this yet.
• GDPR requirements: Technical and organizational measures to comply with the General Data Protection Regulation, including secure processing of personal data, access controls, encryption concepts, and documentation of processing activities.
• Risk assessment: Systematic identification and evaluation of IT security risks using established methodologies. Each risk is assessed by likelihood and potential impact, enabling informed prioritization.
• Action planning: Concrete, prioritized recommendations with implementation support. You receive a detailed action catalog with clear responsibilities, timelines, and estimated effort.

Typical engagement process

Each engagement is unique but follows a proven framework:

1. Free initial consultation (30–60 min): We discuss your current situation, identify the most pressing needs, and clarify open questions. You then receive a proposal that fits your needs.
2. Status quo analysis: Systematic assessment of your IT infrastructure, existing security measures, and organizational processes, on-site or remote.
3. Risk assessment and strategy development: Based on the analysis, I identify and evaluate risks and develop a security strategy for your situation.
4. Results presentation: You receive a clear report with concrete recommendations, prioritized by urgency and effort.
5. Implementation support: On request, I support you during implementation of recommended measures and remain available for questions.

Background

Alongside consulting, I do research at the CISPA Helmholtz Center for Information Security, for example on how development teams handle credentials in code repositories and why cryptographic updates fail in practice. That helps me judge which measures work in day-to-day operations.

Who is it for?

My consulting is available for organizations in Hannover, Braunschweig, Bremen, Hamburg, and across Germany, on-site and remote. Particularly suited for:

• Small and mid-sized companies that need to meet regulatory requirements such as NIS2 or GDPR and want an outside assessment of their security posture, often without a security team of their own.
• Technology companies and startups that want to integrate security into their products and processes from the beginning.
• Organizations handling sensitive data, such as in healthcare, financial services, or public administration, that must meet elevated protection requirements.