KRITIS Experts in Munich

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

Project content: The use of “Generative Pretrained Transformer” technologies (GPT) will massively change the world of work in the coming years. ITZBund is developing a base service for this, which can be used by its 200 customers. This base service is offered as an on-prem and a cloud variant. Started in 12/23, from 05/24 productive systems (based on MVP) could already be rolled out and operated successfully for several agencies and federal ministries.

Project metrics:

• Budget in 2024 approx. €20M
• approx. 70 people in the core project context
• regular (indirect) contact with approx. 80 people in the wider project environment

My main tasks:

• Overall responsible external project manager
• Project definition phase/project setup and establishment of the project organization
• Strategic and operational project planning, as well as shaping and ongoing adjustments of the project
• Ongoing coordination with project owners and stakeholders in ITZBund
• Ongoing coordination with subproject managers, agile roles and other project staff
• Responsibility for project controlling, quality management, risk management and change management
• Responsibility for providing the base service on on-prem and cloud environments and its continuous development
• Planning and leading several hypercare phases
• Collaboration and ongoing coordination with a partner project of a federal ministry and provision of an MVP
• Coordination with agile teams
• Coordination with operations, release and deployment
• Responsibility for the implementation of the first customer projects
• Responsibility for creating an AI governance
• Ensuring accessibility (BITV)
• Responsibility for setting up a subproject for marketing activities
• Support in building an efficient proposal process
• Stakeholder management

Methodology:

• V-Model XT ITZBund
• Scrum

Tools used:

• Microsoft Office, Skype, MS Project, Confluence, Jira, SharePoint, Miro

• Directed full lifecycle of embedded software projects including LiDAR, BMS, OCU, and Cybersecurity systems.
• Coordinated internal and external stakeholders including suppliers like Bosch, Bertrandt, Magna, Continental and IAV.
• Managed cross-country teams of 12–15 engineers, conducting project onboarding and role-based training.
• Implemented change control and risk registers for safety-critical automotive platforms.
• Oversaw project schedules using MS Project, JIRA, and Azure DevOps to ensure milestone alignment and transparency.
• Extensive hands-on expertise in test planning and execution for ECUs in compliance with Automotive SPICE (SWE.4–SWE.6) and ISO 26262.
• Led digital transformation project with a cross-functional team of 15+, ensuring successful integration of systems and workflows.
• Maintained project overviews and tracking in tools like Milestones (Daimler) and MS Project, and managed status reporting to senior stakeholders.
• Coordinated with third-party transformation partners and ensured timely delivery of decision templates and risk assessments.
• Applied PRINCE2 methodology for structured delivery; facilitated agile ceremonies and maintained Confluence-based documentation.
• Strong leadership in cross-functional teams and working in agile environments (SAFe, Scrum).
• Successfully led and supported IT and transformation projects, including those in regulated sectors (e.g., KRITIS or energy sector).
• Represented or supported overall project leadership in large-scale transformation programs.
• Maintained and updated complex project plans (Gantt charts, milestone tracking, and resource allocation).
• Coordinated workstreams and interdisciplinary teams; ensured timely delivery of all work packages.
• Acted as central communication point between project team, senior management, external vendors, and transformation partners.
• Prepared and delivered concise status reports, steering committee presentations, and decision memos.
• Identified project risks, maintained risk registers, and led mitigation planning.
• Assessed resource needs and supported reallocation based on project priorities and constraints.
• Proficient in JIRA, Milestones, Confluence, MS Project, MS PowerPoint, and Excel.
• Used both Agile (Scrum) and Waterfall (PRINCE2, PMI) methodologies.
• Created and tracked action lists, meeting protocols, and backlog items.
• Conducted critical analysis of project progress, resource bottlenecks, and deliverable timelines.
• Ensured alignment of transformation goals with enterprise IT architecture and business objectives.

• Analysis and optimization of the VMware environment for operation in a critical infrastructure environment
• Planning and execution of updates for the VMware and hardware environment in a critical infrastructure environment
• Deployment of Skyline Health Diagnostics
• Review of existing documentation
• Training and onboarding of new internal staff
• Support for migration and upgrade projects
• Preparation for moving scripts in the virtualization environment to GitLab
• Ticket handling with ServiceNow

• Topics: Business Analysis, Data Privacy, Data Management, Stakeholder Management, Conceptualization
• This project focuses on developing and implementing a strategic approach for data deletion in SAP systems. The goal is to identify the relevant data and structures during system migration to ensure both data privacy and IT system efficiency. At the same time, downtime should be minimized and regulatory requirements met.
• Development of a comprehensive approach for data deletion in SAP systems, considering data privacy and business requirements.
• Ensuring efficient and structured data transfer to the new system.
• Optimizing system efficiency and reducing downtimes during migration.
• Creating functional and technical concepts to ensure compliant and sustainable data management.
• Topic preparation: Detailed study of the "data deletion" area to lay the foundation for a structured data migration.
• Definition of project structure: Setting roles, interfaces and the project's organizational structure.
• Regulatory requirements: Analysis of data privacy regulations and business requirements to define deletion criteria.
• Approach: Developing possible scenarios and methods for data cleansing and deletion.
• Deletion concepts: Creating functional and technical deletion concepts that structure the implementation and provide clear guidelines.
• Setting deletion criteria: Defining which data and structures to delete or transfer.
• Responsibilities: Clarifying responsibilities within the project team and among stakeholders.
• Analysis of ongoing activities: Identifying and collecting existing activities in the "data deletion" area.
• Effort, cost and timeline planning: Creating estimates for resources, effort and budget.
• Implementation initiatives: Developing and executing concrete measures to apply the defined deletion strategies.
• IT system efficiency: Analyzing the existing IT infrastructure to identify optimization potential for data deletion and transfer.
• Technology trends: Evaluating new technologies and tools that can support the data cleansing process.
• Cost-benefit analysis: Assessing the financial impact of data cleansing and the introduction of new solution approaches.
• Risk management: Identifying potential risks during implementation and developing appropriate mitigation measures.
• This project lays the foundation for a sustainable and compliant data transfer to a new SAP system. With a clear approach to data deletion, it meets data privacy requirements, reduces downtimes and increases the efficiency of the new system. The results and recommendations will help companies develop a future-proof data strategy that meets legal and business needs.

• Pentesting of mobile applications
• Code review
• Gematik audit
• Development of secure software development methods
• Creation of security and test concepts
• Penetration testing of software and architecture
• Vulnerability analysis
• Automation and information security
• Use of Confluence and Jira
• Working with databases, J2EE, JavaServer Faces, Liquibase, Apache, Maven, Mercurial, Oracle Financials
• Documentation and creation of security policies
• Management of software systems, SharePoint, PrimeFaces, Git
• Compliance with security regulations and .NET, AWS, API
• Tools: MobSF, Frida, Android Studio, Drozer, Objection, Azure

• Planned and initiated BIA/BCM assessment to identify risk mitigation measures and process optimization, and provide risk transparency to the general management
• Evaluated KRITIS/NIS-2 status and implemented requirements
• Created comprehensive digital roadmap and ISO 27001/NIS-2/Data Privacy KRITIS roadmap
• Enhanced crisis management process and documentation
• Integrated information security clauses into customer and supplier contracts to ensure compliance with internal and regulatory requirements
• Ensured organizational readiness for audits by the Landesbehörde für Aufsicht (LBA) and supported audit processes
• Improved asset management processes and classification of sensitive data to strengthen overall security
• Planned and ordered regular penetration tests (internal, external) to identify vulnerabilities and improve security measures
• Performed compliance checks against EU CER requirements and reporting
• Created management status and risk reports to ensure transparent communication of risks and security posture
• Managed registration with the German Federal Office for Information Security (BSI) and provided ongoing status updates
• Conducted risk assessment of supply chain, enhanced evaluation and reporting processes
• Improved IT/OT network segmentation to enhance security and reduce potential audit risks
• Strengthened cyber resilience by proactive measures and enhanced security frameworks and KPI reporting
• Onboarded SIEM/SOC/EDR to improve cybersecurity monitoring and response
• Planned and conducted awareness trainings for employees, administrators, and management
• Enhanced incident reporting processes to ensure timely and accurate reporting of cybersecurity events
• Created AI policy in cooperation with the Legal department to secure use and governance of Artificial Intelligence within the organization
• Scoped and implemented ISO 27001:2022 requirements as part of the Information Security Management System
• Served as interim InfoSec team lead
• Introduced information security to global KAM and Sales organization
• Improved admission and access management including privileged access
• Conducted internal audits in collaboration with internal audit department