In short: IT security consulting for mid-sized companies does not start with a product. It starts with an inventory: which systems exist, what can be reached from the internet, and who holds which rights. From that comes a list ranked by risk, and the top of that list usually looks the same: multi-factor authentication, disciplined patching, backups with an offline copy, an incident response plan and staff training. Architecture and a penetration test follow. Good consulting delivers reports your own team can carry forward without the consultant.

Inventory and risk-based priorities

What nobody knows about does not get patched or monitored. That is why every information security engagement for a mid-sized company begins with an inventory in three parts:

  • Assets. Assets are everything worth protecting: servers, laptops, network devices, cloud accounts, applications and the data they hold. Each asset gets an owner and a rating of how critical it is to operations. ISO/IEC 27001:2022 requires such an inventory (Annex A 5.9).
  • External attack surface. Everything reachable from the internet: websites, remote access (VPN), mail servers, portals and forgotten test systems. Attackers start here because they need no prior access.
  • Identities. Accounts of staff, administrators, service providers and services. What matters is who has admin rights, which accounts are orphaned and where one password unlocks several systems.

The result is not a binder for the shelf but a work list. It shows where the most important data sits and which paths lead to it.

Priorities by risk, not by gut feeling

Risk combines two questions: how likely is damage, and how badly would it hit operations. An unpatched login page on an internet-facing remote access gateway weighs more than a flaw on an isolated test device. The consultant rates every finding this way and puts it into an order that fits budget and staff. For management, this becomes a short overview: risk, possible impact, measure, owner, deadline.

The first measures that almost always come first

The exact order depends on the company. These five points, however, rank high in most assessments:

  1. Multi-factor authentication (MFA). A second proof, such as an app or a hardware key, is added to the password. A stolen password alone is then no longer enough. Start with email, remote access, cloud accounts and every admin account.
  2. Patch and vulnerability management. Patches are security updates from vendors. A fixed process defines who installs them and within what timeframe. Regular scans show which known vulnerabilities are still open and whether fixed ones stay closed.
  3. Backups following the 3-2-1 rule. Three copies of the data, on two different types of storage, one of them at another location. At least one copy should be offline or immutable so that ransomware cannot encrypt it as well. What counts is a rehearsed restore, not the mere existence of a backup.
  4. Incident response plan. Who decides in an emergency, who disconnects systems, who informs customers and authorities. Keep the plan on paper too, because your own systems are often unavailable when it matters.
  5. Training. Staff recognise phishing, meaning fake emails designed to trigger clicks or payments, and know how to report a suspicion. Short, repeated sessions work better than one mandatory annual event.

IT architecture consulting and testing by pentest

Segmentation and Zero Trust in plain terms

Once the basics are in place, the question becomes how far an attacker gets once inside. This is where IT architecture consulting comes in.

  • Segmentation. The network is split into zones, for example office, servers, production, guests and IT administration. Firewalls between the zones control which connections are allowed. An infected office laptop then does not automatically reach the production control systems. ISO/IEC 27001:2022 covers this as segregation of networks (Annex A 8.22).
  • Zero Trust. No device and no user is trusted by default, not even inside the company network. Every access is checked by person, device and purpose, and everyone gets only the rights their task requires. Zero Trust is not a product you buy but a step-by-step rebuild, usually starting with identities and remote access.

Test instead of assume: the penetration test

A penetration test shows whether the measures hold. Specialists attack your systems with written permission, the way real attackers would, and prove which vulnerabilities can actually be exploited. A vulnerability scan lists known flaws automatically, a pentest shows the path from first access to critical data. The test makes most sense after the first measures, so it finds new issues rather than confirming known ones. Process, testing depth and reporting are described on our penetration testing page, with guidance on scope and cost in the article Penetration testing for mid-sized companies.

Regulatory context: NIS 2 and ISO 27001

For many mid-sized companies in Germany, IT security is now also a legal duty. Since 6 December 2025, the NIS 2 Implementation Act has applied, together with the revised BSI Act (BSIG). Whether a company is in scope depends on sector and size (Section 28 BSIG). Important entities are companies from the sectors in Annexes 1 and 2 with at least 50 employees, or with both annual turnover and balance sheet total above EUR 10 million. Entities in scope must implement risk management measures under Section 30 BSIG. The law lists, among others, risk analysis, incident handling, business continuity with backup management, training and multi-factor authentication. The measures above are therefore not optional extras. Management must oversee implementation and take part in training regularly (Section 38 BSIG).

ISO/IEC 27001:2022, by contrast, is voluntary. The standard describes an information security management system (ISMS): defined roles, rules and processes a company uses to steer its information risks. A certificate helps with customers and in tenders and covers large parts of the NIS 2 requirements. The article ISO 27001 and NIS 2 compared sets out how the two relate.

How to recognise sound IT security consulting

  • Independent of product sales. The recommendation follows the risk, not a product range. Ask whether the consulting is tied to commissions on software or hardware.
  • Traceable reports. Every finding with evidence, severity, recommendation and a reference to the standard or law, plus a summary for management.
  • Retest. After remediation, someone checks that the measure works. Without a retest it remains unclear whether the gap is really closed.
  • Clear scope. Goals, systems and deliverables are agreed in writing beforehand, for a pentest including the written authorisation.
  • Handover. At the end, your team can continue the measures on its own.

How GermanAI Defense helps

We start with an inventory of assets, external attack surface and identities and derive a list ranked by risk. We then support implementation: vulnerability management, network security with segmentation, a step-by-step move to Zero Trust, awareness training through the GAD Academy and penetration tests with retest. On request, we provide SOC monitoring around the clock, with service and response times as set out in the contract. We are ourselves certified to ISO/IEC 27001:2022 (certificate no. 26052601).

→ All services at a glance: Cybersecurity Services

→ Check scope and obligations: NIS 2 consulting

→ On the way to certification: ISO 27001 consulting

Sources

As of 28 October 2026. This article is a professional overview and does not replace legal advice in individual cases.