KRITIS Experts in Germany

• Conducted security assessments for supplier qualification, business unit onboarding, and ongoing reviews of service providers and partners (Ongoing Assurance).
• Assessed technical and organizational measures (TOMs) against GDPR and information security requirements.
• Handled security reviews and approval processes in the Global Approval Navigator (OneTrust).
• Advised business units and IT on information security, security requirements, and risk-appropriate measures.
• Supported the development of SOC/SIEM processes and tools as part of the ISMS in line with ISO/IEC 27001.
• Analyzed cyber threats and coordinated security objectives and measures to address Security Findings with the SOC team.
• Monitored and assessed current security advisories and security-related metrics (KPIs).
• Reviewed, assessed risks, and approved exception requests (Security Exceptions).
• Independently analyzed and handled Security Events and supported the handling of security incidents.
• Planned and supported awareness initiatives to strengthen security awareness.
• Created, implemented, and reviewed information security policies and standards.
• Conducted protection needs analyses and gap assessments to identify security gaps and risk deviations.
• Defined and reviewed technical and organizational risk treatment measures.
• Advised on Third Party Governance with consideration of DORA, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, and BCM in line with ISO 22301.

Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as Support, Finance, Developers, and Security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA topics and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.

Tools/Frameworks: FIDO, Yubikey, Veridium, BSI Grundschutz, NIST

Management of data protection & IT security-related projects. Adjustments to knowledge management and consulting processes.

Activities:

• Data protection consulting
• Process optimization in in-house consulting
• Interface to specialist departments, IT security, development and management

• Established a cyber resilience framework for AI-accelerated threats in the Frontier AI Threat Endurance (FATE) program: capability assessments, maturity assessments and gap analyses covering cyber security, operational resilience, incident response, recovery and governance, followed by target concepts and improvement measures
• Supported action owners from specification through implementation: implementation roadmaps, decision papers, management presentations and governance reporting, as well as audit- and supervision-ready documentation; managed stakeholders from IT, Information Security, Risk Management, Operational Resilience, Business Continuity and the business units

• Strategic planning, detailed technical preparation and operational management of an email gateway migration in a security-critical government environment.
• Preparation of the technical specification and development of technical concepts and migration approaches in line with BSI requirements.
• Technical requirements management with business units, information security and operations.
• Coordination of external service providers, integrators and implementation partners; maintenance of project plans, milestones, resources, risks and dependencies.
• Regular reporting to project management, the program environment and internal stakeholders.

• Private Equity owned precision grinding machines for Auto, Military & Aerospace – 1200 Employees
• Acting as Interim Group CIO / CISO consolidating Global IT back to Europe – M&A consolidation
• Managed major Security event and post event cleanup – Reporting to regulators
• Performed Vendor & Contract Management – full assessment of capabilities
• Guided Infrastructure refresh & Security Hygiene assessments

As Germany’s only large integrated energy company, EnBW covers the entire value chain—from energy generation and distribution to serving customers. The company is expanding its renewable energy sources, working toward a socially responsible coal phase-out, and advancing key technologies such as the use of green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW.  Developing and implementing an end-to-end process view that takes both technical and organizational aspects into account  Ensuring end-to-end control of all IAM-related technical services  Establishing clear responsibilities and accountabilities across the IAM landscape  Working with various departments to identify and optimize an end-to-end architecture and act as the Single Point of Contact (SPoC) for Information Security  Introducing and monitoring governance policies to ensure compliance and security  Continuously improving IAM processes and systems through regular audits and service reviews  Taking part in external process audits as part of official audits against ISO standards  Further developing the policy that sets administrative requirements and procedures, and aligning it with administrative departments  Conceptually developing the KPI system for measuring process quality

• Requirements management, process planning, interface function, ISMS setup, and documentation
• Setup and establishment of an ISMS according to ISO 27001 and establishment of emergency management / ITSCM
• Coordination of the circumstances with the public-sector IT service provider
• Consideration of KRITIS relevance within the scope and implementation of a B3S
• Development of requirements for document control and the continuous improvement process
• Preparation of relevant project documents
• Analysis of existing processes and preparation of guidelines
• Requirements gathering for ISMS and ITSCM and coordination with the IT service provider, including definition of interfaces
• Analysis of communication processes and escalation paths
• Review of documents for risk management, ISMS, emergency preparedness, and emergency response
• Redesign of the complete documentation and preparation of new relevant documents
• Development of necessary rules, policies, and concepts
• Interface between customer and service provider to ensure document quality
• Coordination of protection needs with specialist departments, particularly regarding KRITIS relevance, and planning of resulting measures
• Development of preventive measures to minimize the risk of data center outages in scenarios such as pandemics or ransomware attacks
• Definition of the test strategy for IT emergency exercises
• Initiation of necessary awareness training measures for specialist departments
• External Information Security Officer
• Introduction of document control

• Built a scalable nearshore IT developer hub (Croatia, Czech Republic, Poland) as an independent company through a BOT model (Build – Operate – Transfer)
• Identified, selected, and managed full-service agencies; introduced management and control mechanisms, including KPIs, SLAs, and regular service reviews
• Prepared and reviewed data processing agreements and framework contracts in coordination with Legal & Compliance; integrated regulatory requirements (including KRITIS) into process design
• Advised on cloud vs. on-premise strategies, data storage, and authorization concepts; supported Procurement with tendering and service provider evaluations
• Managed change and process harmonization between internal teams and nearshore partners; reported to executive management, CFO, and CIO

Result: Scalable IT developer hub with an audit-ready governance model, reduced operating costs, and accelerated product development.

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

Project overview: The use of “Generative Pretrained Transformer” (GPT) technologies will greatly change the world of work in the coming years. ITZBund is developing a basic service for this purpose, which can be used by its 200 customers. This basic service is offered both on-premises and in the cloud. Launched in 12/23, production systems (based on the MVP) had already been successfully rolled out and operated for several authorities and federal ministries by 05/24.

Project metrics:

• 2024 budget approx. 20 Mio €
• approx. 70 people directly involved in the project
• regular (indirect) contact with approx. 80 people in the wider project environment

My main responsibilities:

• Overall responsibility as external project manager
• Project definition phase/ Project setup and establishment of the project organization
• Strategic and operational project planning, as well as project design and ongoing adjustments
• Ongoing coordination with the project owner and stakeholders at ITZBund
• Ongoing coordination with sub-project managers, agile roles, and other project team members
• Responsibility for project controlling, quality management, risk management, and change management
• Responsibility for providing the basic service in on-premises and cloud environments and its ongoing development
• Planning and leading several hypercare phases
• Collaboration and ongoing coordination with a federal ministry partner project and delivery of an MVP
• Coordination with the agile teams
• Coordination with operations, release, and deployment
• Responsibility for delivering initial customer projects
• Responsibility for developing AI governance
• Ensuring accessibility (BITV)
• Responsibility for setting up a sub-project for marketing activities
• Support in setting up an efficient proposal process
• Stakeholder management

Approach:

• V-Modell XT ITZBund
• Scrum

Tools used:

• Microsoft Office, Skype, MS Project, Confluence, Jira, Sharepoint, Miro

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
• Overall responsibility for establishing a Compliance, Governance and Risk organization
• Establishment of an integrated GRC model and executive reporting for the Management Board.

Support for Transformation Projects:

• Expert CTO advisory and enterprise architecture consulting for several short-term transformation projects, ensuring measurable improvements in project outcomes and technical business alignment.
• Supporting strategic IT initiatives for diverse clients, driving digital transformation and optimizing technology operations to increase business value and operational efficiency.