ISO 27001 Experts in Germany

Project: Digital Sovereignty - Toll Collect

Workshop: Digital Sovereignty

Recognize dependencies, reduce risks, remain capable of acting. In this one-day practical seminar, I support companies in systematically analyzing their digital dependencies, assessing legal and operational risks, and developing a concrete plan to increase their digital sovereignty. Participants map their entire IT infrastructure, identify critical dependencies on non-European providers and create a prioritized risk matrix based on GDPR, NIS2 and EU AI Act. We then develop options for action together, ranging from a hybrid model to a complete migration to European solutions, and create an individual sovereignty roadmap with responsibilities, milestones and budget framework. The seminar is aimed at executive management, IT managers, data protection officers and compliance functions and is designed for six to 16 participants.

Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as Support, Finance, Developers, and Security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA topics and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.

Tools/Frameworks: FIDO, Yubikey, Veridium, BSI Grundschutz, NIST

Management of data protection & IT security-related projects. Adjustments to knowledge management and consulting processes.

Activities:

• Data protection consulting
• Process optimization in in-house consulting
• Interface to specialist departments, IT security, development and management

• Impact: Structured requirements analysis and quality assurance as a foundation for the further development of a software solution.
• Analysis, documentation, and coordination of requirements. Conducting stakeholder analyses, interviews, and workshops to gather and validate requirements. Conducting requirements reviews and working closely with business departments and development teams.

Techniques & Tools: Requirements Engineering, Stakeholder Management, Workshop Facilitation, System Context Modeling, Requirements Reviews, Quality Scenarios, Miro, Jira, Confluence

Assignment focus: Leading digital restructuring in a highly regulated Defence and Aerospace environment. Focus areas: improving data flows and data quality, introducing paperless data collection in production, integrating machine data for automatic SPC calculation and process control, as well as cybersecurity analyses.

Main objectives:

• Analyze, structure and improve data flows and data quality in production
• Introduce paperless data collection in manufacturing areas
• Integrate machine data for automatic SPC data calculation and process control
• Implement digital restructuring while meeting regulatory requirements in the Defence environment

Measures and results:

• Analyzed and structured existing production data flows as a basis for control and reporting
• Established mechanisms to ensure data quality and availability across manufacturing areas
• Introduced paperless data collection in production — replacing manual and paper-based processes
• Integrated machine data for automatic SPC data calculation (control charts, Cp/Cpk) and real-time process control
• Conducted cybersecurity analyses in the production and IT environments

Area of responsibility: Project management for digital restructuring, paperless production, data management and data quality in a highly regulated Defence and Aerospace environment.

• Strategic planning, detailed technical preparation and operational management of an email gateway migration in a security-critical government environment.
• Preparation of the technical specification and development of technical concepts and migration approaches in line with BSI requirements.
• Technical requirements management with business units, information security and operations.
• Coordination of external service providers, integrators and implementation partners; maintenance of project plans, milestones, resources, risks and dependencies.
• Regular reporting to project management, the program environment and internal stakeholders.

• Requirements management, process planning, interface function, ISMS setup, and documentation
• Setup and establishment of an ISMS according to ISO 27001 and establishment of emergency management / ITSCM
• Coordination of the circumstances with the public-sector IT service provider
• Consideration of KRITIS relevance within the scope and implementation of a B3S
• Development of requirements for document control and the continuous improvement process
• Preparation of relevant project documents
• Analysis of existing processes and preparation of guidelines
• Requirements gathering for ISMS and ITSCM and coordination with the IT service provider, including definition of interfaces
• Analysis of communication processes and escalation paths
• Review of documents for risk management, ISMS, emergency preparedness, and emergency response
• Redesign of the complete documentation and preparation of new relevant documents
• Development of necessary rules, policies, and concepts
• Interface between customer and service provider to ensure document quality
• Coordination of protection needs with specialist departments, particularly regarding KRITIS relevance, and planning of resulting measures
• Development of preventive measures to minimize the risk of data center outages in scenarios such as pandemics or ransomware attacks
• Definition of the test strategy for IT emergency exercises
• Initiation of necessary awareness training measures for specialist departments
• External Information Security Officer
• Introduction of document control

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

• Managed Microsoft Cloud Accelerator Factory (CAF) programs for global enterprise customers, ensuring Azure cloud implementations aligned with security, governance, and compliance best practices, including ISO 27001-aligned controls and cloud security frameworks.
• Managed complex global enterprise transformation programs with strong focus on project delivery, financial governance, budget control, planning, risk management, and executive reporting, ensuring delivery within scope, timeline, and budget.
• Led the implementation of e-invoicing solutions for Nestlé, coordinating finance, IT, business stakeholders, and external providers to ensure successful integration, testing, rollout, and delivery of electronic invoicing processes.
• Managed an Oracle-to-PostgreSQL database migration, coordinating technical teams, application owners, testing activities, dependencies, risks, and cutover planning to ensure a controlled and successful transition.
• Led cross-functional programs involving finance and payment-related processes, enterprise platforms, and system integrations, with strong stakeholder management across business, IT, vendors, and senior leadership.
• Delivered transformation programs in FMCG environments, including Nestlé, managing complex international stakeholder structures, third-party providers, governance, RAID management, and business-critical dependencies.

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
• Overall responsibility for establishing a Compliance, Governance and Risk organization
• Establishment of an integrated GRC model and executive reporting for the Management Board.

International Family-Owned Company | Revenue of more than 1 billion EUR | CONFIDENTIAL

• Established and operationalized a company-wide PMO; took over the initial management function during ongoing operations.
• Structured a portfolio of more than 15 strategic transformation initiatives across several countries and functions.
• Designed project intake, decision levels, responsibilities and regular steering meetings; management reporting as well as risk and dependency management.
• Established the PMO environment with Microsoft 365, Planner Premium, Teams, SharePoint and Forms; planned reporting and prepared the structured handover to an internal PMO organization.

• Designed and moderated a NIS2 preparation workshop for RAS Reinhardt Maschinenbau GmbH and its IT service provider Catuno GmbH. Together with executive management and IT leadership, the current status was assessed, an initial GAP analysis was conducted and areas for action were prioritized based on ISO 27001.
• Developed an ISO-27001-based regulatory framework (ISMS) for NIS2 compliance, including a structured current/target GAP analysis, targeted improvement of the security maturity level and preparation of the organization for NIS2 audit readiness.

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

The program supports the comprehensive realignment of the German Consumer Panel Services business. It combines a significant panel boost with the reprocessing of historical data and the integration of new receipt data. By significantly expanding and stabilizing the panel with the involvement of external partners, the aim is to improve the validity of the data base and create a reliable foundation for methodology, weighting and customer reporting. At the same time, historically grown processes for data delivery, OCR, matching, item QC, methodology and reporting are being harmonized, further developed technologically and reorganized. The goal is a scalable end-to-end landscape with higher data quality, clear responsibilities, reliable governance and sustainably manageable operational processes.

• Overall management of the restatement program, including the integrated roadmap as well as milestones, dependencies, risks and management decisions.
• Coordination of the panel boost and alignment of the required data deliveries, quality requirements and prerequisites for methodology, weighting and reporting.
• Alignment of business, product, data science, technology, operations and external partners around a shared target picture, aligned priorities and an integrated approach.
• Design of the organizational change triggered by the fundamental realignment of the data base, methodology and management logic, which has a lasting impact on established decision-making and collaboration patterns.
• Establishment and further development of governance, reporting and escalation structures as well as program-wide monitoring and operational processes for reliable management and sustainable handover.
• Management of critical data, technology and provider dependencies, including reprocessing, OCR transition and the timely synchronization of delivery, testing, methodology and reporting.
• Orchestration of international collaboration with teams and stakeholders in Germany, the United Kingdom, Portugal and Romania, as well as with external suppliers in Germany and Austria.

Impact Areas and Expertise: Program & Delivery Leadership, Business & Technology Alignment, Organization & Transformation, Governance & Sustainable Operations, Strategy & Target, Methodic Leadership, Transformation & Change Leadership, Executive Advisory