IT-Sicherheitsgesetz Experts in Germany
for compliant critical infrastructure with fast, precise matching and vetted freelancersHire experts who translate the IT-Sicherheitsgesetz into practical security measures, BSI requirements and audit-ready evidence. Work with professionals who understand KRITIS, incident reporting and information security management, matched quickly with vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used IT-Sicherheitsgesetz
Federico L.
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developed and implemented a holistic process view covering both technical and organizational aspects Ensured end-to-end control of all IAM-related technical services Established clear responsibilities and accountabilities within the IAM landscape Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security Introduced and monitored governance policies to ensure compliance and security Continuously improved IAM processes and systems through regular audits and evaluations Participated in external audits of the process as part of official ISO audits Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units Conceptually advanced the KPI system to measure process quality
Andreas I.
Last position:
Cybersecurity Specialist Assessor at Bundesnetzagentur
- Recognition of national notified bodies
- Preparation of cybersecurity competency reports
- EU Radio Equipment Directive
Arndt S.
Last position:
Information Security Officer according to TISAX at Automotive Supplier
Anette G.
Last position:
Managing Director at promismanagement services GmbH
- Leading and building integrated management systems (IMS) for quality (QMS), data protection and information security (ISMS), risk (GRC), and artificial intelligence (AI) in accordance with ISO 9001, ISO 27001, ISO 42001, ISO 21500, ISO 21502, ISO 37301, ISO 31000
- Governance, project, and transformation management nationally and internationally incl. enterprise and project governance
- Process development, optimization, and business process reengineering according to BPMN 2.0, Kaizen, IATF 16949, VDA, BPMN 2.0
- Compliance and risk management in the company and project context as well as connection to internal control systems (ICS) and Group Risk Compliance (GRC)
- Carrying out and leading internal audits and lead audits according to ISO 19011; audit management and test equipment / special equipment management
- Methodical and systemic coaching (IFS, Hakomi) as well as conflict moderation and change management
- Designing and delivering AI trainings, prompt engineering, and AI literacy workshops
- Advising on data protection impact assessments (DPIA), implementing EU GDPR, BDSG, and IT-SiG as well as NIS-2 and DORA
- Building and leading Program Management Offices (PMO) and introducing Project Management Office structures
- Contract management, clause-by-clause analyses, and project controlling according to PMI® standards incl. Earned Value Management
- Building knowledge, document, and content management systems (Confluence, SharePoint, EY iManage)
Jan K.
Last position:
Consultant for Information Security & Auditor at Kopiasonsulting GmbH
Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures
Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks
Conducting red teaming processes, including penetration tests and security analyses for companies
Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)
Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX
Advising companies in critical infrastructures on information security and compliance with the IT Security Act
Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)
Integrating data into monitoring tools (Prometheus, Grafana)
Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management
Security assessments and penetration testing of IT and network architectures
Lucas L.
Last position:
Consultant in Information Security, Data Protection and Business Continuity Management
Consulting and support in gathering information security requirements (IT-SIG 2.0, KRITIS, TISAX, industry standards, ISO 27001, A-960/1)
Acting as data protection officer and auditor as well as information security auditor
Conducting employee training
Updating risk analyses with risk treatment
Designing information security concepts based on BSI IT Baseline Protection, KRITIS, ISO 27001, A-960/1 and TISAX
Identifying information security requirements for IT systems (WAN, LAN, clouds) and overseeing implementation
Administering the ISMS using Verinice and SAVe
Integrating security concepts into existing management systems according to ISO 9001 and ISO 27001
Process management and modeling according to ITIL
Management consulting for integrating an ISMS into integrated management systems
Advising on data protection (GDPR, BDSG)
Planning and conducting data protection audits
Designing risk management processes and methodologies according to ISO 27005, ISO 31000 and BSI 200-3
Developing and setting up training programs for employees
Ralf L.
Last position:
Chief Information Security Officer at Stadtwerke Krefeld Holding AG
- Building an information security management system for the entire group
- Supporting 2 KRITIS subsidiaries
Stephan H.
Last position:
Compliance Consultant at Bitexpert
- Making new compliance norms easily readable
Daniel J.
Last position:
Information Security Consultant
- Enhanced quality assurance of documents, processes and required evidence in preparation for the upcoming KRITIS audit 2025.
- Reviewing and commenting on all relevant documents.
- Advising authors and document owners on inquiries and during the creation process.
- Supporting departments with IT security inquiries.
- Used tools/Frameworks MS Office, SharePoint, Jira, Confluence, ISO27001+, NIS-2 (EU 2022/2555), B3S (Statutory Health & Private Health Insurance), BSIG / IT-SIG 2.0, BSI-KritisV, BSI-C5, BSI Baseline Protection (200-2, 200-4), ServiceNow, RCE (EU 2022/2557), SGB, GDPR
Manfred L.
Last position:
Senior Consultant Information Security at Creditplus Bank AG
- Designing the information security process based on ITIL 4
- Designing the ITIL 4 incident and change management processes
- Creating information security policies for the bank
- Support in the project for internal audit findings
- Advising on the setup of the bank's internal control systems (ICS)
- Advising on setting up ICS processes
- Advising and supporting security architecture and risk analysis of the existing IT landscape, including IT security architecture, data management, data compliance & physical security
- Advising and project leadership for the security concept of the bank's assets
- Advising and support in contracts with external service providers to meet the bank's regulatory (BAIT; MaRisk; DORA; NIS2; GDPR) and information security requirements
- Support in planning and implementing a SOC/SIEM and risk management
- Support for the spam email team in analyzing and handling incidents
Stephan S.
Last position:
IT-Security Manager at Large industrial corporation with multiple international locations
- Planning and managing all projects in the context of IT security
- Establishing a Cyber Security Incident Response procedure according to ISO/IEC 27035
- NIS2 readiness: impact analysis, planning and implementation of NIS2 compliance
- Management reporting based on KPIs
Discover over 15,000 top freelancers
Statistics of experts using IT-Sicherheitsgesetz
Aggregated from the professional profiles of matched freelancers.
Experience
21 years
Position duration
2.6 years
Positions per freelancer
13
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Professional Services, Information Technology, Banking and Finance
Certification focus areas
Audit, Information Technology, Quality Assurance
Bachelor's degree or higher
100%
Master's degree or higher
100%
Doctorate
25%
Certifications per freelancer
11
Most common languages
German, English, French
Speak two or more languages
100%
Based on our profile pool as of 19 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Germany using IT-Sicherheitsgesetz
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 19 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
IT-Sicherheitsgesetz experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Professional Services (91%)
- Information Technology (64%)
- Banking and Finance (45%)
- Manufacturing (45%)
- Government and Administration (45%)
- Energy (36%)
- Insurance (36%)
- Transportation (36%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
Legal framework
The IT-Sicherheitsgesetz is Germany’s legal framework for improving information security in organisations with critical digital services and infrastructure. It works closely with the Bundesamt für Sicherheit in der Informationstechnik, the BSI, and related rules such as the BSI Act, or BSIG. The requirements depend on the organisation, its services and its classification under applicable regulations.
KRITIS obligations
Companies affected by the framework must identify relevant systems, protect them against disruption and demonstrate that security controls work in practice. This includes governance, risk management, technical safeguards, monitoring, documentation and cooperation with responsible authorities. The IT-Sicherheitsgesetz is therefore not a single software product but a compliance and security programme spanning people, processes and technology.
Systems and sectors
The rules are relevant to organisations whose services support essential parts of public life. Depending on the case, this can include energy, healthcare, finance, transport, water, telecommunications and information technology. Specialists commonly support work such as:
- Classifying services and systems under KRITIS and BSI requirements
- Mapping assets, dependencies, risks and responsible owners
- Preparing incident reporting and escalation procedures
- Creating evidence for audits, assessments and supervisory reviews
Standards and tooling
Strong work combines legal interpretation with hands-on information security. Relevant practices include ISO 27001, BSI IT-Grundschutz, security risk assessments, business continuity, vulnerability management, identity and access controls, logging and incident response. Depending on the environment, professionals also work with SIEM systems, endpoint protection, network segmentation, cloud controls and configuration management.
When expertise helps
Companies often bring in freelance specialists during a new KRITIS classification, a regulatory assessment, a security programme rollout or a major change to critical systems. External expertise can also help when internal teams need an independent view or when documentation has fallen behind operational reality. Germany-based projects may require German-language communication with authorities, auditors and internal stakeholders, while technical delivery can often be organised remotely.
What strong specialists deliver
The best professionals connect the wording of the IT-Sicherheitsgesetz with controls that teams can operate and prove. They clarify scope early, distinguish mandatory measures from sensible improvements and document decisions in a traceable way. They also understand that resilience depends on suppliers, cloud services, recovery exercises and clear ownership, not only on perimeter security.
Frequently asked questions
Before you brief your next project: the most common questions about IT-Sicherheitsgesetz.
The IT-Sicherheitsgesetz sets security and reporting expectations for organisations whose services are important to public life, especially in critical infrastructure. Companies use it to structure risk management, protective controls, incident response and evidence for regulatory review.
The IT-Sicherheitsgesetz provides the legal basis for important requirements affecting KRITIS organisations, while the BSI publishes guidance and performs supervisory functions in relevant areas. The BSI-KritisV helps define which facilities and services may fall within critical infrastructure rules.
IT-Sicherheitsgesetz compliance is a legal obligation, whereas BSI IT-Grundschutz is a structured method for designing and documenting information security. ISO 27001 can provide a recognised management-system framework, but neither standard automatically replaces an organisation’s specific legal duties.
A strong IT-Sicherheitsgesetz specialist usually understands information security management, risk analysis, ISO 27001, BSI IT-Grundschutz, business continuity and incident response. Depending on the environment, useful adjacent skills include cloud security, supplier risk, SIEM operations, data protection and audit preparation.
For a narrow gap analysis, a specialist needs a clear understanding of the relevant scope, systems and obligations rather than a large programme history. A broad implementation or remediation effort calls for experience connecting governance with technical controls, operational processes and defensible documentation.
Much of an IT-Sicherheitsgesetz project can be delivered remotely through workshops, document reviews, risk sessions and evidence tracking. On-site work may still be useful for sensitive environments, facility inspections, stakeholder meetings or assessments where access restrictions prevent remote collaboration.
For IT-Sicherheitsgesetz work, ask the specialist to explain how they determine scope, map obligations to controls and test whether evidence is usable. Look for precise deliverables, familiarity with BSI terminology, clear handling of sensitive information and the ability to communicate with both technical and executive stakeholders.
The IT-Sicherheitsgesetz 2.0 expanded and refined security expectations in several areas, so specialists must check the current legal and regulatory context instead of relying on older templates. Companies should select professionals who verify which provisions apply to their sector, services, systems and organisational role.
The average hourly rate of freelancers in Germany who have used IT Security Act in their recent projects is 124 €, which corresponds to a daily rate of about 994 € based on an 8-hour working day.
Of the freelancers in Germany who have used IT Security Act in their recent projects, 100% hold at least a Bachelor's degree, 100% hold at least a Master's degree, and 25% hold a doctorate.
On average, freelancers in Germany who have used IT Security Act in their recent projects have 21 years of professional experience, with a single engagement typically lasting around 2.6 years.
The most common languages among freelancers in Germany who have used IT Security Act in their recent projects are German (100%), English (100%), and French (27%).
The most common industries among freelancers in Germany who have used IT Security Act in their recent projects are Professional Services (91%), Information Technology (64%), and Banking and Finance (45%).
The most common business areas among freelancers in Germany who have used IT Security Act in their recent projects are Information Technology (91%), Project Management (82%), and Quality Assurance (82%).
Main locations of FRATCH Experts, who have recently used IT-Sicherheitsgesetz
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
