Henry (Michael) Hanau-Interim CISO, DPO, AI Officer

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Commissioned by: CFO, platform product owner

Successes/results (early phase):

• Compliance support for building an internal unified data usage platform based on Databricks.
• Created the basis for legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data exports from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

• Industry: vehicle manufacturing, heavy machinery
• Regulations: GDPR, NIS-2, SOX, BetrVG, ISO 27001, TISAX
• Project focus: data protection, IT security, IT risk management, organizational development, digital transformation
• Commissioned by: management (CFO)
• Personnel responsibility: 4 FTE (ad interim)

Successes/results:

• Personnel and content restructuring of the IT function and linking IT operations (networks, workplace, SAP) with the newly created IT GRC function.
• Prevented the resignation of key staff (2 FTE), personnel adjustment (1 FTE).
• Built and scaled a company-wide IT GRC function, hired and trained a 4-person team, and reduced compliance gaps by 70% during the assignment: ensured SOX compliance, license compliance, and increased IT security by 80% compared to the previous state.
• Integrated the German IT GRC unit into the national organization. Connected the German GRC unit to the international parent organization. Set up permanent coordination forums and increased the visibility of the German branch's interests by 100%.
• Led the rollout of Microsoft 365 (M365) across all EU/international subsidiaries, negotiated enterprise agreements, and added works council agreements.
• Structured analysis to determine NIS-2 scope. Trained executives on the resulting obligations.
• Introduced ISO 27001 ISMS, prepared the organization for NIS-2 compliance, and reduced third-party risk. Aligned coverage with existing cyber risk insurance.
• Negotiated more than 10 works council agreements for platform services and HR tools; ensured legal compliance while keeping operational flexibility.

• Industry: banking
• Regulations: GDPR, BDSG
• Project focus: data protection, IT compliance, IT audit, IT risk management
• Commissioned by: group data protection officer

Successes/results:

• Led an 18-month company-wide GDPR compliance audit that identified several high- and medium-risk gaps; implemented remediation measures that reduced regulatory risk to 0. Kept within time and budget and received full positive final approval.
• Designed and introduced a uniform data protection control framework -> significantly reduced response time in audits and data subject requests.
• Revised the entire CMS in terms of acceptance and effectiveness, complete translation into English.
• Conducted complex data protection impact assessments (DPIAs).

• Industry: Banking
• Regulations: KWG, GWG, MaRisk, eIDAS, BAIT, DORA, GDPR, ISO 27001
• Project focus: Data protection, IT security (2nd line of defense), IT audit, IT compliance, IT risk management
• Commissioned by: Managing Director, Group Data Protection Officer, specialist project managers

Achievements/Results:

• Analysis and assessment of specific apps and their provider/user relationship on behalf of the 2nd line (of defense) and in light of data protection, information security, terms and conditions, and DORA.
• Analysis and assessment of specific video ID solutions on behalf of the 2nd line and in light of data protection, information security, terms and conditions, and GWG.
• Analysis and assessment of specific digital signature solutions on behalf of the 2nd line and in light of data protection, information security, terms and conditions, and eIDAS.
• Conducted structural audits on behalf of the 2nd line of the implemented ISO 27001 ISMS (protection needs of IT assets, gap analyses, risk analyses). Related tool experience: OneTrust, Schleupen R2C.
• Revised the procurement process for IT products and IT services from an information security perspective, designed a streamlined process / specific requirements on behalf of the 2nd line; accepted roll-out of a new aligned procurement policy, inclusion of relevant clauses in the company terms and conditions with consideration of future legal requirements (especially DORA).
• Supported the 1st line of defense with recurring asset valuations.
• Analysis of the technical setup of various cloud services with regard to compliance: Microsoft O365, SAP on hyperscalers.
• Further development of the existing framework to comply with the EU GDPR. Supported the project-leading in-house counsel in all data protection matters.
• Development and successful introduction of a semi-automated template for assessing data protection risks of processing activities. Conducted data protection impact assessments and transfer impact assessments for data transfers to unsafe third countries.
• Development and implementation of an ISO 19600-oriented data protection management system (DPMS) -> achieving a 90% compliance rate on the first day of GDPR applicability.
• Served as the company data protection officer for a subsidiary.

• Industry: Wholesale, specialty products
• Regulations: GDPR, HGB
• Project focus: Data protection, IT security, IT audit, IT risk management, organizational development
• Commissioned by: Corporate Compliance Officer (Legal Department)
• Personnel responsibility: 2 FTE (direct), 8 (indirect)

Achievements/Results:

• Chair of an international data protection organization in 8 countries, aligning locally different approaches with EU standards and significantly reducing cross-border compliance risks.
• Setup of the IT audit department within group audit / defining the annual audit program.
• Lead auditor for the audit: Cut-over to SAP ERP 6.0 Global (no findings in the audit).
• Management of complex cross-border IT audits.
• Writing audit reports tailored to the target audience (C-level, IT, accounting, tax).
• Follow-up management.
• Trained a classic auditor to become an IT auditor, including CISA certification.