Henry (Michael) Hanau-Interim CISO, DPO, AI Officer

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

• Industry: vehicle manufacturing, heavy machinery engineering
• Regulations: GDPR, NIS-2, SOX, BetrVG, ISO 27001, TISAX
• Project focus: data protection, IT security, IT risk management, organizational development, digital transformation
• Assigned by: management (CFO)
• Personnel responsibility: 4 FTE (ad interim)

Successes/Results:

• Restructured the IT function in terms of people and content, and linked IT operations (networks, workplace, SAP) with the newly created IT GRC function.
• Prevented the resignation of key staff (2 FTE), staffing adjustment (1 FTE).
• Built and scaled an enterprise-wide IT GRC function, hired and trained a 4-person team, and reduced compliance gaps by 70 % during the assignment: ensured SOX compliance, license compliance, and increased IT security by 80% compared to before.
• Integrated the German IT GRC unit into the national organization. Connected the German GRC unit to the international parent organization. Set up permanent exchange committees and increased the visibility of German branch interests by 100%.
• Led the rollout of Microsoft 365 (M365) across all EU/international branches, negotiated enterprise agreements, and added works council agreements.
• Structured analysis to determine NIS-2 applicability. Trained managers on the resulting obligations.
• Introduced ISO 27001 ISMS, prepared the organization for NIS-2 compliance, and reduced third-party risk. Coordination with coverage under the existing cyber risk insurance policy.
• Negotiated more than 10 works council agreements for platform services and HR tools; ensured legal compliance while maintaining operational flexibility.

• Industry: banking
• Regulations: GDPR, BDSG
• Project focus: data protection, IT compliance, IT audit, IT risk management
• Assigned by: group data protection officer

Successes/Results:

• Led an 18-month enterprise-wide GDPR compliance audit, identifying several high- and medium-risk gaps; implemented remediation measures that reduced regulatory risk to 0. Completed on time and within budget with full positive final approval.
• Drafted and introduced a uniform data protection control framework -> significant reduction in response time for audits and data subject requests.
• Revised the complete CMS with regard to acceptance and effectiveness, fully translated into English.
• Conducted complex data protection impact assessments (DPIAs).

• Industry: Banking
• Regulations: KWG, GWG, MaRisk, eIDAS, BAIT, DORA, GDPR, ISO 27001
• Main focus: Data protection, IT security (2nd line of defense), IT audit, IT compliance, IT risk management
• Mandated by: management, group data protection officer, technical project managers

Achievements/Results:

• Analysis and assessment of specific apps and their provider/user relationship on behalf of the 2nd line of defense and in light of data protection, information security, terms and conditions, DORA.
• Analysis and assessment of specific video identification solutions on behalf of the 2nd line and in light of data protection, information security, terms and conditions, and GWG.
• Analysis and assessment of specific digital signature solutions on behalf of the 2nd line and in light of data protection, information security, terms and conditions, and eIDAS.
• Conducted structural audits on behalf of the 2nd line of the implemented ISO 27001 ISMS (protection needs of IT assets, gap analyses, risk analyses). Relevant tool experience: OneTrust, Schleupen R2C.
• Revised the procurement process for IT products and IT services from an information security perspective, designed a streamlined process / specific requirements on behalf of the 2nd line; accepted rollout of a new aligned procurement policy, inclusion of relevant clauses in the company terms and conditions with consideration of future legal requirements (especially DORA).
• Supported the 1st line of defense in recurring asset reviews.
• Analysis of the technical setup of various cloud services with regard to compliance: Microsoft O365, SAP on hyperscalers.
• Further development of the existing framework to comply with the EU GDPR. Supported the in-house counsel leading the project in all data protection matters.
• Development and successful rollout of a semi-automated template for assessing data protection risks of processing activities. Conducted data protection impact assessments and transfer impact assessments for data transfers to unsafe third countries.
• Development and implementation of an ISO 19600-oriented data protection management system (DPMS) -> reaching a 90% compliance rate on the first day the GDPR became applicable.
• Served as company data protection officer for a subsidiary.

• Industry: Wholesale, specialty products
• Regulations: GDPR, HGB
• Main focus: Data protection, IT security, IT audit, IT risk management, organizational development
• Mandated by: Corporate Compliance Officer (legal department)
• Personnel responsibility: 2 FTE (direct), 8 (indirect)

Achievements/Results:

• Chair of an international data protection organization in 8 countries, aligning locally different procedures with EU standards and significantly reducing cross-border compliance risks.
• Set up the IT audit department within group internal audit / defining the annual audit plan.
• Led the audit: Cut-over to SAP ERP 6.0 Global (no findings in the annual audit).
• Managed complex cross-border IT audits.
• Wrote audit reports tailored to the target audience (C-level, IT, accounting, tax).
• Follow-up management.
• Trained a traditional internal auditor to become an IT auditor, including CISA certification.