Define your GRC consulting needs

Information security management system (ISMS), the basis for certification.

Check whether you are in scope, implement risk management under Section 30 BSIG, set up reporting.

Records of processing, technical and organizational measures, impact assessments, processor agreements.

Classify AI applications, clarify duties per risk class, build documentation.

The BSI method and modules, often required in public administration.

Digital operational resilience for banks, insurers and their IT providers.

Emergency planning, business impact analysis and recovery of critical processes.

We clarify with you which frameworks apply.

We start with an as-is assessment and build structures step by step.

Initial processes or documents exist, but no complete management system.

The system runs, but needs to become more structured, evidence-ready, or audit-ready.

An existing certification should be extended, maintained, or re-certified.

You are not sure where you stand. We start with an inventory.

Clarify which duties apply and check the current state against the framework.

Build or sharpen processes, roles, policies and evidence.

Structure risk identification, assessment, treatment, and reporting.

Preparation for internal audits or the audit by an accredited certification body.

BCM framework, business impact analysis, crisis and emergency exercises.

Classify AI applications, assess risks, build controls and documentation.

Train employees, leaders, and roles with security responsibility.

Federal, state and local government and public bodies.

Operators of critical facilities, such as energy, water, health or transport.

Bank, insurance, financial-services provider with additional supervisory duties.

Manufacturing, engineering, automotive, machinery. Often with OT components.

Mid-market company, IT, software, or service provider.

Describe your industry in the note when you send the request.

Small business, startup, small agency.

Classic mid-market with its own IT organization.

Several business units, often with its own compliance function.

Group, agency, or large organization with division and subsidiary structures.

A specific event, audit, contractual obligation, or regulatory deadline is coming.

Planned project slot. Enough time for a structured build-up.

Multi-stage program, often in parallel with ongoing business operations.

Multi-year build-up or continuous support.