NIS2 Expert in Munich

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

Consulting and support in the areas of sales/business/technology/development/marketing:

• Sales, Key Account Management
• Business Development, business/corporate development
• Partner management
• Program/project management
• Product management & marketing
• Technical marketing, content marketing
• New business, innovation and technologies

Until July 2021 active as advisor and consultant for Mixed Mode in the areas of Key Account Management, Project Management and Business Development.

From Q3/2021 successful delivery of various customer projects in the area of Business Development, corporate development, consulting, coaching, technical content management, sales and marketing:

• EMS service provider and PCB test house, inspection systems: revision of company portfolio and presentation. Integration of specialized distribution for optical inspection systems from Japan: content management, marketing, communication, web, sales automation, lead generation
• Full service marketing agency – technology marketing for industry: expansion of the existing B2B and B2C marketing portfolio with industrial and technology topics: content management, presentation and focus on "technical marketing", web, target market and customer analysis, lead automation, consulting
• Software product manufacturer & software development in the field of security for Embedded & IoT: company alignment and portfolio definition for an IoT and Embedded Security company with a SaaS solution for IoT device management: building a partner network to offer complete Embedded/IoT security solutions, technical content, company alignment and portfolio definition, strategy & planning, target market and customer analysis, product marketing/USPs for the security device management tool "IoT-Suite", standards and regulations for cyber resilience (e.g. CRA, NIS2, RED), web content, SEO, management of marketing and sales agencies, CRM, sales, presentations, trade fairs, congresses, building company webinars & events
• Software engineering service provider/system house for IoT, Embedded, web, mobile and desktop applications: business development, content creation, customer acquisition and sales
• Manufacturer of memory products with security features as an add-on: memory products in standard form factors (SD, CF, SSD...) are extended with security modules such as HSM, TPM or secure elements and thus offer users secure data storage, transfer and access. Also interesting as an upgrade or retrofit solution to meet the coming new regulations and requirements regarding cybersecurity such as CRA, RED and NIS2. Business & New Business Development for the area "Embedded IoT Solutions & Security", sales & marketing. Expansion of the pure semiconductor business to include security solutions and services. Interface between management, marketing, sales and product management. Building business partners, technology partners, system integrators and resellers from the Embedded, IoT, OT and IT environment. Creating reference designs/demos/lighthouse cases and proof of concepts for cross- and reference selling. Co-marketing with security partners. Technical content creation for web, sales and marketing, webinars, social media etc. Networking, participation in trade fairs, congresses and events. Lead generation, qualification, follow-up and conversion to customer. Product definition, USPs, features. Analysis of competitors, market positioning, target markets - strategy, concept and measures - go to market.
• Marketing agency group with sales and management consulting: consulting for companies on restructuring, market analysis and market entry, go-to-market concepts, customer acquisition and expansion, new customer generation, lead generation and management, concepts and execution of campaigns (web, mail, social media, phone outreach in person or with AI voice assistant, webinars...). Processing and managing customer product data for PIM product information and DAM data asset management systems. Focus on customers in the industrial and technology environment with products and services that need explanation.

• Topics: Business Analysis, Data Privacy, Data Management, Stakeholder Management, Conceptualization
• This project focuses on developing and implementing a strategic approach for data deletion in SAP systems. The goal is to identify the relevant data and structures during system migration to ensure both data privacy and IT system efficiency. At the same time, downtime should be minimized and regulatory requirements met.
• Development of a comprehensive approach for data deletion in SAP systems, considering data privacy and business requirements.
• Ensuring efficient and structured data transfer to the new system.
• Optimizing system efficiency and reducing downtimes during migration.
• Creating functional and technical concepts to ensure compliant and sustainable data management.
• Topic preparation: Detailed study of the "data deletion" area to lay the foundation for a structured data migration.
• Definition of project structure: Setting roles, interfaces and the project's organizational structure.
• Regulatory requirements: Analysis of data privacy regulations and business requirements to define deletion criteria.
• Approach: Developing possible scenarios and methods for data cleansing and deletion.
• Deletion concepts: Creating functional and technical deletion concepts that structure the implementation and provide clear guidelines.
• Setting deletion criteria: Defining which data and structures to delete or transfer.
• Responsibilities: Clarifying responsibilities within the project team and among stakeholders.
• Analysis of ongoing activities: Identifying and collecting existing activities in the "data deletion" area.
• Effort, cost and timeline planning: Creating estimates for resources, effort and budget.
• Implementation initiatives: Developing and executing concrete measures to apply the defined deletion strategies.
• IT system efficiency: Analyzing the existing IT infrastructure to identify optimization potential for data deletion and transfer.
• Technology trends: Evaluating new technologies and tools that can support the data cleansing process.
• Cost-benefit analysis: Assessing the financial impact of data cleansing and the introduction of new solution approaches.
• Risk management: Identifying potential risks during implementation and developing appropriate mitigation measures.
• This project lays the foundation for a sustainable and compliant data transfer to a new SAP system. With a clear approach to data deletion, it meets data privacy requirements, reduces downtimes and increases the efficiency of the new system. The results and recommendations will help companies develop a future-proof data strategy that meets legal and business needs.

• Development of global PR and media relations work
• Topic scouting, coordination, and alignment

• 21 projects ≥ 6 months at large and medium-sized companies
• 13 projects as project or subproject manager
• 6 international projects with English as project language

• Consulting in IT sourcing, tendering procedures, and process management
• Drafting procedure and contract documents
• Project and document management as well as quality assurance
• Analysis and optimization of business processes
• Conflict analysis, contract review, and solution development

• Advising clients on ISO/IEC 27001, TISAX, BSI IT-Grundschutz and GDPR
• Trainer and internal auditor
• Contract management (service and work contracts, framework agreements)
• Coordinating and supporting tender responses
• Developing strategies and measures for clients and new business opportunities (e.g. phishing, online awareness trainings)
• Further developing the governance/risk/compliance offering
• Account management for existing clients and new business acquisition
• Supporting HR with hiring and interviews

• Planned and initiated BIA/BCM assessment to identify risk mitigation measures and process optimization, and provide risk transparency to the general management
• Evaluated KRITIS/NIS-2 status and implemented requirements
• Created comprehensive digital roadmap and ISO 27001/NIS-2/Data Privacy KRITIS roadmap
• Enhanced crisis management process and documentation
• Integrated information security clauses into customer and supplier contracts to ensure compliance with internal and regulatory requirements
• Ensured organizational readiness for audits by the Landesbehörde für Aufsicht (LBA) and supported audit processes
• Improved asset management processes and classification of sensitive data to strengthen overall security
• Planned and ordered regular penetration tests (internal, external) to identify vulnerabilities and improve security measures
• Performed compliance checks against EU CER requirements and reporting
• Created management status and risk reports to ensure transparent communication of risks and security posture
• Managed registration with the German Federal Office for Information Security (BSI) and provided ongoing status updates
• Conducted risk assessment of supply chain, enhanced evaluation and reporting processes
• Improved IT/OT network segmentation to enhance security and reduce potential audit risks
• Strengthened cyber resilience by proactive measures and enhanced security frameworks and KPI reporting
• Onboarded SIEM/SOC/EDR to improve cybersecurity monitoring and response
• Planned and conducted awareness trainings for employees, administrators, and management
• Enhanced incident reporting processes to ensure timely and accurate reporting of cybersecurity events
• Created AI policy in cooperation with the Legal department to secure use and governance of Artificial Intelligence within the organization
• Scoped and implemented ISO 27001:2022 requirements as part of the Information Security Management System
• Served as interim InfoSec team lead
• Introduced information security to global KAM and Sales organization
• Improved admission and access management including privileged access
• Conducted internal audits in collaboration with internal audit department

IT Carve-out

Chemical industry (500 employees)

• Completed the infrastructure separation from the former US parent company within the TSA deadline
• Successfully completed the tenant-to-tenant migration of Microsoft 365 for all 500 users: from the former parent company's tenant to the newly established company's own tenant (Exchange Online, SharePoint, Teams)
• Separated the network (LAN/SD-WAN), Active Directory and server infrastructure
• Negotiated IT service contracts through a structured tender process
• Initiated cyber security measures
• Supported the selection of service providers for data protection and NIS2 certification