Risk Management
Capture and assess risks and steer them in a risk register that both management and auditors can read.
·FIVE SERVICE BUILDING BLOCKS
Compliance you can actually steer
We combine ISO 27001, NIS 2, GDPR, the EU AI Act and risk management into one clear program of measures, controls and evidence.
ISO 27001
Building an ISO 27001 ISMS up to certification readiness, with support during the audit by an accredited certification body.
NIS 2
Clarify whether you are in scope, implement the duties under Section 30 BSIG and document them, for essential and important entities.
GDPR
Establish and maintain GDPR compliance. Optimize data protection processes, reduce regulatory risk.
EU AI Act
Classify AI applications under the EU AI Act, implement and document the obligations for each risk class.
We live what we advise GermanAI Defense has itself been certified to ISO/IEC 27001:2022 since May 2026, audited by the accredited certification body A-Mark Ratings Limited (certificate no. 26052601, valid until 25 May 2029). More on Security & Compliance →
·ONE MANAGEMENT SYSTEM
Four frameworks, one control system
ISO 27001, NIS 2, the GDPR and the EU AI Act ask for many of the same things: risk analysis, access rules, incident processes, training. We build one shared ISMS for all of them. Each control is implemented once and mapped to every framework that requires it.
- ISMS
- Information security management system: defined roles, policies and processes a company uses to steer its information risks and review them regularly.
- Control
- A concrete rule with an owner, for example: administrator rights are reviewed every quarter.
- Evidence
- Proof that the control works, such as a review record. One piece of evidence can serve several frameworks.
Simplified view. Under the EU AI Act, obligations depend on your role and on the risk class of the AI system.
·OBLIGATIONS AT A GLANCE
Who is affected and what applies
The four frameworks in brief: who they apply to, what they require and what we contribute. Pick a framework.
ISO 27001
International standard, voluntarySteer information security verifiably and have it certified.
- Voluntary
- Certificate valid for three years
- Annual surveillance audit
- Who
- Any organization that wants to steer information security in a verifiable way. Customers and tenders often ask for the certificate.
- What it requires
- An ISMS with risk assessment, suitable controls from Annex A and continual improvement. The certificate is issued by an accredited certification body.
- What we do
- Build the ISMS up to certification readiness and support you in the audit. To ISO 27001 consulting →
NIS 2
EU directive, in Germany via the BSIGCybersecurity obligations for companies in certain sectors.
- Registration with the BSI
- Reporting in 24 h, 72 h, 1 month
- Management training (§ 38 BSIG)
- Who
- Companies in certain sectors such as energy, health, transport, digital infrastructure and parts of manufacturing. As a rule from 50 employees or more than €10 million turnover and balance sheet total.
- What it requires
- Risk management under § 30 BSIG and reporting of significant incidents in three stages. Management approves the measures, oversees them and must attend training regularly.
- What we do
- Check whether you are in scope, prepare the registration, set up measures and the reporting path, train management. To NIS 2 consulting →
GDPR
EU regulation, since 25 May 2018Protection of personal data, applies to practically every company.
- Since 25 May 2018
- Data breach: notify without undue delay, where feasible within 72 h (Art. 33)
- Who
- Every company that processes personal data.
- What it requires
- A legal basis for each processing activity, a record of processing activities and technical and organizational measures to protect the data (Art. 32).
- What we do
- Merge data protection and information security into one catalog of measures and document it.
EU AI Act
EU regulation, phased applicationRules for AI systems, graded by risk class.
- AI literacy (Art. 4) since 2 February 2025, amended July 2026
- High-risk obligations postponed by the Digital Omnibus
- Who
- Providers, deployers, importers and distributors of AI systems used or offered in the EU. You are a deployer as soon as your company uses AI in its own operations.
- What it requires
- Measures that support staff AI literacy (Art. 4, amended in July 2026) and a ban on certain practices. Further obligations depend on the risk class. Under the Digital Omnibus they are expected to apply to high-risk AI from December 2027 and to AI in regulated products from August 2028.
- What we do
- Record and classify AI applications, implement the obligations per class, train AI literacy through the GAD Academy.
Also covered: BSI IT-Grundschutz, e.g. for public bodies or as a basis for critical-infrastructure audits, and DORA for financial entities.
As of September 2026. This overview explains the basics and does not replace legal advice in the individual case. Whether and how your company is affected is something we clarify in the gap analysis.
·DELIVERABLES
What you hold at the end
Every GRC project ends with documents your team can maintain on its own and an auditor can review.
- 01
Gap analysis
Your current state compared with the requirements of the frameworks, each gap with a priority.
- 02
Risk register
All information risks with rating, owner and planned measure.
- 03
Policies
Information security policy and topic-specific policies, approved by management.
- 04
Action plan
Who implements what by when, sorted by risk and effort.
- 05
Evidence file
Statement of Applicability (which ISO controls apply and why), record of processing activities, training and review records, sorted by framework.
- 06
Audit support
Internal audit first, then preparation for and support during the certification body's audit.
·BUSINESS CONTINUITY · BCM
When the worst case hits, operations stay able to act
For NIS 2 entities business continuity is mandatory (Section 30(2) no. 3 BSIG), ISO 27001 covers it in controls A.5.29 and A.5.30, ISO 22301 provides the framework. We build the BCM framework, identify critical processes, rehearse the crisis case and steer the recovery sequence until it is solid.
Framework & Governance
Build the BCM framework, anchor policies and governance structures, manage recurring compliance activities.
Business Impact & Risk
Map critical business processes, perform Business Impact Analyses (BIA) and risk assessments, derive RTO / RPO.
Disaster Recovery & Restart
Create disaster recovery plans, define restart sequences, regular testing and optimization of the recovery paths.
Crisis Management
Set up and coordinate crisis management teams, plan crisis exercises and BCM tests, carry lessons learned into regular operations.
·APPROACH
From gap analysis to audit-ready operations
Five phases in which frameworks, risks, controls, evidence and audit are considered together.
- 01
Gap analysis
Systematically assess frameworks, maturity, gaps and risks
- 02
Target picture
Define scope, compliance goals and roadmap
- 03
Measures
Implement controls, processes, documentation and technical safeguards
- 04
Evidence
Provide risk register, records of processing activities (RoPA), Statement of Applicability (which ISO controls apply and why) and audit trail
- 05
Audit & Operations
Internal audit, support through certification and continuous improvement
Start: gap analysis of your current stateResult: audit-ready operations
For operational implementation, Cybersecurity can be connected as a complement, from the 24/7 SOC to penetration-testing support.
View Cybersecurity →Questions about GRC? Answers
What does GRC mean?
GRC stands for governance, risk and compliance. It describes one shared control system: requirements, risks, controls and evidence come together in one place instead of in separate projects per framework.
How do GRC and ISO 27001 relate?
ISO 27001 defines the information security management system (ISMS) and provides the structure for GRC: risk assessment, Annex A controls, statement of applicability and internal audits. The same controls and evidence cover many NIS 2 requirements and the technical and organizational measures under GDPR.
Is GRC software or a consulting service?
The term is used for both. We deliver consulting and implementation, not a software license: gap analysis, risk register, policies, action plan, evidence file and audit support. GRC software manages risks and controls. Which controls apply to your organization and how they are evidenced is defined by the program.
What role does AI play in GRC?
In GRC, AI is first of all a subject of review. The EU AI Act requires organizations to record AI applications, classify them by risk class and document the obligations per class. We handle inventory, classification and implementation and train AI literacy through the GAD Academy.
Where does a GRC program start?
With the gap analysis. We assess frameworks, maturity, gaps and risks of your current state. This leads to the target picture and roadmap, followed by measures, evidence, and audit and operation.