Daniel J.-Information Security Consultant

NIS2 Implementation Project and ISMS Development Based on IT-Grundschutz

Municipal utilities, public-law institution

• Analysis of the current compliance status regarding the requirements of the NIS Directive (NIS-2, EU 2022/2555).
• Identification of critical infrastructures and processes within the organization.
• Development of an action plan to meet NIS requirements.
• Conducting a risk analysis in accordance with BSI Standard 200-3 as the basis for the security concept.
• Preparation of an individual security concept including technical and organizational measures according to BSI IT-Grundschutz.
• Preparatory support for an optional certification according to BSI IT-Grundschutz.
• Adaptation of existing security policies and development of new ones for access controls, incident management and data protection.
• Consideration of municipality-specific requirements and integration of the measures into the existing IT infrastructure.
• Documentation of the results and preparation of audit-ready evidence for audits.

Tools, languages and frameworks used: MS Office, Verinice, IT-Grundschutz (200-x), NIS-2 (EU 2022/2555), ISMS, AI-Act (EU 2024/1989)

NIS2 Implementation Project - Italy

Pharmaceutical industry & medical technology, corporate group

To achieve NIS2 compliance at an Italian company in the field of medical product manufacturing, the current implementation of the measures affected by NIS2, both in IT and OT (MSR / measurement, control and regulation equipment), must be documented as part of a gap analysis and subsequently closed.

• Gap analysis / assessment of the measures currently implemented in relation to the NIS2 target state
• Support for specialist departments with IT security requests
• Definition and coordination of the necessary measures, support for implementation and introduction of an ISMS
• Review, commenting on and improvement of processes; revision and preparation of policies, frameworks and related documents (operating concepts and manuals, security concepts, role and access rights concepts, emergency plans and BCM concepts/documentation, network structure diagrams, etc.)

Tools, languages and frameworks used: MS Office, SharePoint, ISO27001/ff., ISO31000, IEC62443, ISO22301, NIS-2 (EU 2022/2555), ISMS, TRBS 1115 Teil1, CSA (EU 2019/881), NIST CSF 2.0, SP 800-53, SP 800-37, GAMP, GxP, DECRETO LEGISLATIVO n. 138

NIS2 Implementation Project

Food wholesale and industry, medium-sized company (family-owned)

• Gap analysis / assessment of the measures currently implemented in relation to the NIS2 target state
• Support for specialist departments with IT security requests
• Definition and coordination of the necessary measures, support for implementation and introduction of an ISMS
• Review, commenting on and improvement of processes; revision and preparation of policies, frameworks and related documents (operating concepts and manuals, security concepts, role and access rights concepts, emergency plans and BCM concepts/documentation, network structure diagrams, etc.)

Tools, languages and frameworks used: MS Office, SharePoint, ISO27001/ff., ISO31000, IEC62443, ISO22301, NIS-2 (EU 2022/2555), ISMS, Intervalid ISMS Tool, TRBS 1115 Teil1, CSA (EU 2019/881)

NIS2 Implementation Project

Commodities trading/industrial minerals, corporate group

• Gap analysis / assessment of the measures currently implemented in relation to the NIS2 target state
• Supporting specialist departments with IT security inquiries
• Defining and coordinating the necessary measures and supporting their implementation, as well as introducing an ISMS
• Reviewing, commenting on and improving processes; revising and creating policies, frameworks and related documents (operating concepts and manuals, security concepts, role and access concepts, contingency plans and BCM concepts/documentation, network structure plans, etc.)

Tools, languages, frameworks used: MS Office, SharePoint, ISO27001/ff., ISO31000, ISO22301, NIS-2 (EU 2022/2555), ISMS, Intervalid ISMS Tool

• Contributing to the DORA project within the operational IT security subproject to implement the necessary measures to meet regulatory requirements.
• Creating concepts for maintaining and preparing the protection requirements analysis and the information network.
• Creating technical instructions (information network, protection requirements assessment) based on the policies and specifications.
• Modeling the target data model and architecture in a high-level representation within the Information Network & Protection Requirements subproject.
• Contributing to and optimizing process design for incident management and ICT incident management.
• Contributing to the creation of manuals and instructions.
• Coordinating and defining processes and procedures for ICT incident management, particularly the identification of incident types.
• Used tool/Frameworks MS Office, SharePoint, ISO27001/ff., DORA (EU 2022/2554), BAIT, BSI Grundschutz, RiMaGo, SBIT, PSD2, ZAG.

• Identification of the controls that the Asset Management unit does not evaluate efficiently, and definition of measures to close these gaps.
• Identification and review of the interfaces with other departments and teams.
• Communication with internal project stakeholders.
• Conducting interviews with stakeholders and adjacent teams.
• Planning and conducting workshops.
• Analysis of current processes, controls, documentation, and ways of working, and review of their effectiveness.
• Analysis of the existing Asset Management controls, identification and presentation of gaps.
• Determination, documentation, and presentation of measures to close the identified gaps.
• Used tool/Frameworks MS Office, SharePoint, ISO27001/ff., ISO27019, IEC62443, IEC62351, IT Sicherheitskatalog (IT-SiG), NIS-2 (EU 2022/2555), KRITIS, NIST, BDEW Whitepaper, BNetzA, BSI-C5, BSI Grundschutz (200-4).

• Support in implementing an effective separation of IT and OT following an inventory of the facilities and network infrastructure.
• Participation in the first phase of a comprehensive redesign of the IT and network landscape.
• Review of and contribution to the RfP proposal and presentation slides.
• Preparation and execution of on-site workshops to determine the current state.
• Participation in the protection requirements analysis.
• Setup of a vulnerability scanner and execution of corresponding vulnerability scans and analyses for servers, services, and applications in operation using Greenbone / GVM.
• Used tools/Frameworks MS Office, SharePoint, ISO27001/ff., IEC62443, NIS-2, BSI 200-2, Greenbone GVM.

• Taking over and completing an ongoing project to centralize applications hosted locally at decentralized sites into Azure-hosted data centers for a corporate group (70 locations, 8 countries), including all subsidiaries.
• Ensuring that all applications that could not be migrated for non-technical or security-related reasons were taken into account.
• Handover of operations to a defined MSP, including implementation of a new backup solution.
• Management of related subprojects for the migration of various locally hosted applications in several countries.
• Communication with internal project stakeholders.
• Coordination with and management of internal and external responsible parties.
• Preparation of status reports and presentations.
• Coordination and governance of external contractors.
• Escalation management within the program to responsible and accountable bodies.
• Tracking the project timeline and financial execution.
• Used tools MS Office, SharePoint, Jira, ServiceNow.

• Defined strategies and policies according to best practices and available standards based on assessed deficiencies within the company.
• Established policies and requirements for SecSDL, logging and SIEM, patch management, PAM/IAM and other topics.
• Reviewed and revised existing policies and guidelines.
• Frameworks used: ISO27001/ff., NIST, OWSAP, SANS, MITRE ATT&CK, CIS, BSI 200-2.

• Acted as the point of contact for suppliers and specialist groups regarding the lifecycle of HP Blade Center systems and Windows 2012.
• Supported the planning of milestones and schedules for implementing lifecycle activities.
• Supported the creation of high-level procedures and their implementation.
• Reviewed requirements and assumptions on the customer side.
• Supported the pilot project and testing for the introduction of the hardware BLC replacement.
• Created QA acceptance documentation.
• Planned migration waves (application groups) for application migrations.
• Planned migration waves to migrate Windows 2012 servers to the latest OS generation.
• Monitored and followed up on implementation activities by PV/project team members.
• Provided QA progress reporting.
• Maintained required change data in the CMDB.
• Documented the changes from a technical and procedural perspective and handed them over to operations.

• Improvement of manual and outdated patch management processes.
• Creation and development of patch management concepts.
• Automation of processes and increased effectiveness by reducing manual effort.
• Support in building a new group for vulnerability management in the I&O department.
• Support for teams in resolving identified vulnerabilities through escalations and cross-functional coordination.
• Advising managers on strategic decisions in vulnerability and patch management.
• Reporting measurements and vulnerabilities to directors and C-level.
• Frameworks used: VAIT, ISO27001/ff., ITIL, NIST, CSC CIS, BSI KritisV.

• Analysis of existing patch management processes and future objectives.
• Design of new patch management processes based on the objectives.
• Design and definition of new processes to improve patch management workflows.
• Introduction and improvement of previously missing or inadequate processes.
• Alignment of the new processes with the Global IT Security Vulnerability Management Team to ensure sustainability.
• Frameworks used: VAIT, ISO27001/ff., ITIL, NIST, CSC CIS, Kritis.

• Development and support of all I&O departments in addressing security incidents, remediating vulnerabilities, managing security patches, and complying with security regulations.
• Definition of the product vision by translating the technology and business strategy into product objectives with a focus on security and risk reduction.
• Management of product evaluations and definition of product implementations and improvements based on the security threat landscape, technology development, market acceptance, and market development.
• Contribution to the development of the technological vision for I&O from a security perspective, including measures to reduce potential damage.
• Development of and consulting on patch management concepts for various applications and services.
• Identification of core capabilities and functions of journeys/products to achieve strategic objectives and support product line teams.
• End-to-end responsibility for measures in Infrastructure Vulnerability Management based on ISED vulnerability reports and findings.
• Analysis of findings and definition and coordination of measures with the operational area and ISED.
• C-Level consulting.
• Frameworks used: VAIT, ISO27001/ff., ITIL, NIST, CSC CIS, BSI Kritis, BSI Grundschutz (200-2), BCM.

• Defined solutions for addressing and closing audit findings.
• Identified solutions for closing vulnerabilities (vulnerability scanners).
• Determined protection requirements and assessed potential damage to prioritize measures.
• Established sustainable processes based on the patch management concept.
• Designed and optimized patch management processes.
• Assessed process requirements in vulnerability and incident management.
• Designed and redesigned processes in vulnerability and incident management.
• Introduced and established more effective ways of working (e.g. reducing work in progress in IT operations).
• Coordination tasks and liaison between IT security and IT operations.
• Reviewed vulnerability reports, identified asset owners, and assigned vulnerabilities.
• Tracked the timely remediation of vulnerabilities.
• Coordinated the implementation of remediation measures and configuration changes.
• Prepared status reports.
• Managed incidents and problems.
• Planned and moderated workshops.
• Evaluated solutions for vulnerability management.
• Operational and technical tasks in cooperation with other external service providers.
• Checked vulnerabilities for false positives and assessed the applicability of recommended remediation measures.
• Reviewed alternative remediation measures, documented them, and carried them out or submitted requests for risk acceptance.
• Frameworks used: VAIT, ISO27001/ff., ITIL, NIST, CSC CIS, Kritis.
• Tools and languages used: MS Office, Sharepoint, MS SQL, Tenable.SC, BMC Artrium (CMDB), BMC Remedy, BMC SmartIT, BMC myIT.

• Developed a network infrastructure for providing services for vulnerability scanning and penetration tests.
• Reduced network load and increased efficiency through direct access to all VLANs.
• Process consulting and design.
• Project and network documentation.
• Created an operations and installation manual.
• Created a security concept including threat modeling.
• Frameworks used: STRIDE, ITIL.
• Tools and languages used: SM9, Infoblox, MS Office, Microsoft Threat Modelling Tool.

• Maintenance, operation, and further development of the vulnerability scanner.
• Vulnerability management and execution of vulnerability scans.
• Analysis of vulnerabilities.
• Security incident management.
• Preparation of reports.
• Documentation, including the creation and maintenance of installation and operation manuals.
• Process consulting and optimization.
• Connection to the central log management system.
• Used frameworks and tools SM9, BMC Remedy with Smart IT, Tenable SecurityCenter, Tenable Nessus, Tenable Nessus Manager, MS Office, ASG-Remote, vSphere Client, Windows Server, RHEL 7.x, centOS 7.x, Tenable.SC, Kritis.

• Analysis of requirements in merchandise management.
• Creation of business and solution concepts.
• Creation of release notes and user manuals.
• Identification of test cases and test specification/design according to ISQTB.
• Definition of regression tests.
• Execution, documentation, and evaluation of software tests.
• Defect tracking.
• Test status reporting.
• Support during acceptance tests.
• Consulting on the test approach, testing procedures, and test process improvement.
• Used tools Atlassian Jira + Zephyr, Atlassian Confluence, MS Office, XML, SQL, MS SSMS, in-house developments (CRM, merchandise management, order management, goods receipt and dispatch).

• Interim test management and test coordination for a release in Customer Order Management.
• Management of nearshore test teams (Romania).
• Management of the test team and test assignments.
• Creation of documentation and user manuals.
• Defect tracking.
• Reporting of test status.
• Support during acceptance tests.
• Coordination of the test environment.
• VBA (macro) scripting.
• Used tools Atlassian Jira, HP QualityCenter/ALM, MS Office, XML, Aroma, S.A.L.D.O.3, Masterdata, ESB, VBA.

• Analysis of the current state and data structures during the migration of Sage 2.1 (GS-Bestellung) to Sage Professional 2014.
• Creation of a user manual.
• Migration of dBase/Clipper data structures to MS SQL Enterprise 2012.
• Customization of Sage CRM.
• Testing and commissioning of the Sage CRM software solution after the migration.
• Server maintenance (Windows 2012R2 / HyperV).
• Migration of a physical Windows XP computer to HyperV.
• Programming of VBA scripts for Outlook.
• Tools used: Windows 2012 R2, HyperV, SageCRM, Sage 2.1 (GS-Bestellung), MS Office, SQL (MS), MS SSMS, dBase/Clipper, VBA.

• Testing of the concept for M1SS / Mini-One-Stop-Shop.
• Requirements analysis.
• Evaluation of test tools.
• Quality assurance and test planning.
• HPQC training, setup and customization.
• Tools used: HP Quality Center/ALM, MS Office, Sharepoint.

• Derivation of test cases from the application specification for Demo VKB Online.
• Recording of test cases (regression tests) with Silktest.
• Modularization of test case sections.
• Outsourcing of test data from test scripts.
• Implementation of logical logging routines.
• Execution and evaluation of software tests.
• Tools used: Silktest, SQL, Quick Test Pro, HP Quality Center ALM.

• Identification of test cases based on functional and technical specifications in the Columbus3 release team.
• Test specification according to TMAP.
• Execution of tests in Siebel (Sales, Billing), Clarify, OnlineService and interfaces (SAP, RoMA, Venedig).
• Defect tracking and reporting.
• Tools used: Atlassian Jira, PuTTY, WinSCP, IBM Rational Quality Manager/RQM, SoapUI, MS Office, OpenProject, MS Visio, Clarify, RoMA, Venedig, Serena Dimensions, Oracle Siebel CRM (Sales, Invoicing).

• First- and second-level support and incident management as part of the introduction and rollout of Windows Vista.
• User administration.
• Tools used: iET TTS, Windows XP and Vista, MS Windows Server 2003/2008, MS Office.