fact based consulting – quality based services

Security that stands up to scrutiny.

ISO/IEC 27001, IT-Grundschutz, DORA, KRITIS, NIS2 and the GDPR demand more than good intentions: effective controls, resilient processes and documentation that will satisfy an auditor. We get you there – independently, with experience, and without the detours.

Request an initial conversation Explore our services

Four sets of requirements, one partner

Information security, regulation and data protection overlap far more than the legal texts suggest. Address them together and you build once – and demonstrate compliance many times over.

ISO/IEC 27001 and BSI IT-Grundschutz

Information security management system

Establishing, operating and certifying an ISMS – to ISO/IEC 27001, to Germany's BSI IT-Grundschutz, or as ISO 27001 certification on the basis of IT-Grundschutz.

DORA

Digital operational resilience in the financial sector

Implementing DORA's requirements for ICT risk management, incident reporting, resilience testing and third-party risk – for financial entities and their ICT service providers.

KRITIS and NIS2

Compliance evidence for critical infrastructure operators

Preparing for and supporting the KRITIS compliance audits required under Section 39 of the German BSI Act, and implementing the obligations arising from NIS2.

Data protection

GDPR and the Swiss Data Protection Act

Data protection built into your information security rather than bolted on beside it: from gap analysis to ongoing support as your external Data Protection Officer.

Management, IT operations, legal – we speak all three languages.

Who we work for

Financial entities and ICT service providers

Banks, insurers, payment service providers and the suppliers they depend on: DORA demands demonstrable control of ICT risk along the entire supply chain.

Operators of critical infrastructure

Energy, water, health, transport, food and other sectors: anyone within the scope of KRITIS or NIS2 must prove their controls, not merely describe them.

Public authorities and administration

In Germany and Switzerland: ISMS and security concepts under IT-Grundschutz, security architectures, classified information, public procurement – with experience in the public administration of both countries.

Organisations aiming for certification

Companies that need ISO/IEC 27001 as proof for customers, partners or regulators – and want a management system that holds up in day-to-day operations.

What you can expect from us

We do not name clients – confidentiality is part of the service. What we can show is what our consultants bring to the table: verified qualifications and hands-on experience, not textbook knowledge.

Grounded in practice, not stuck in routine

Decades in IT operations, architecture and leadership are our foundation. What we build on it is current: today's standards, new regulation, current technology. To us, experience means spotting patterns early – not recycling old answers.

Qualified where it counts

ISO/IEC 27001 Lead Auditor and Information Security Officer (TÜV-certified), trained IT-Grundschutz practitioners (BSI) – qualifications on a par with those of the people who will eventually audit you.

KRITIS audit expertise

BSI-recognised audit competence for KRITIS compliance evidence (formerly Section 8a, now Section 39 BSIG) – we know these audits from both sides of the table, as auditors and as advisers to operators.

Data protection in two jurisdictions

Data Protection Officers under the GDPR (TÜV) and Swiss data protection advisers (TÜV) – for clients with sites in both jurisdictions.

Rigorous methods, in projects and in operations

Project management to PRINCE2 and HERMES5, agile methods (Scrum), service management to ITIL and ISO/IEC 20000 – all certified. So that security initiatives stay on track and their results land in day-to-day operations.

Leadership experience at group level

Line responsibility for units of up to 1,500 people, with P&L and revenue responsibility in the hundreds of millions: we know how decisions get made in large organisations.

Germany and Switzerland

Engagements for public authorities, critical infrastructure and financial entities in both countries – each with its own standards, procedures and ways of working.

Independent

No ties to vendors, certification bodies or service providers. Our recommendation has only one client: you.

How we work

Four steps that recur in every engagement – whether the goal is a certificate, evidence for the BSI or a supervisory review.

  1. 1

    Assessment

    Where do you stand, what applies to you, what will be audited? We clarify applicability, scope and the yardstick you will be audited against before recommending any controls.

  2. 2

    Gap analysis

    Comparing the current state with the specific requirements of the standard or regulation. The result: a prioritised list of what is missing and what is already good enough.

  3. 3

    Implementation

    We support implementation within your organisation: policies, processes, risk analyses, evidence. Pragmatic, documented, together with your teams.

  4. 4

    Audit support

    Preparation for the certification audit, the Section 39 KRITIS evidence or the supervisory review – through to the result, and then into ongoing operations.

Why we are called Dōjōkun

Dōjōkun are the five precepts that govern how people treat one another in traditional martial arts schools. They are centuries old – and at a time when tempers are shorter and commitments weaker, more relevant than ever. We have made them the foundation of our company philosophy: not as decoration, but as a standard you can hold us to.

  1. 1 Integrity Our recommendation has only one client: you.
  2. 2 Facts Findings, not flattery.
  3. 3 Perseverance It's done when the evidence stands.
  4. 4 Respect How we treat people is part of the service.
  5. 5 Composure Measure first, then act.

The five precepts and what they mean for working with us

Additional services

Security does not exist in a vacuum. Where the real issue is interim leadership, an externally staffed role, a project, procurement or organisational design, we help there too – drawing on four decades of experience in line roles, projects and engagements.

Interim management and outsourced roles

  • External CISO / Information Security Officer – interim or ongoing
  • External Data Protection Officer – interim or ongoing
  • Interim head of IT, architecture or change
  • Health checks and forensic reviews of troubled major projects
  • Project and programme recovery and oversight

Projects, programmes, procurement

  • Project and programme management to HERMES5, PRINCE2 and agile methods
  • Setting up and running project management offices (PMO)
  • Public procurement: WTO/EU tenders, specifications, contract templates
  • Independent assessments of cloud services: security, data protection, risk, strategic fit

Organisation and sourcing

  • IT strategy and governance: rules, processes, structures
  • Demand and supply organisation, IT service catalogues
  • Service management to ITIL and ISO/IEC 20000
  • Restructuring, outsourcing, pre- and post-merger

Training and coaching

  • Training in ITIL, ISO/IEC 20000, HERMES5 and IT security (TÜV/EXIN trainer)
  • Coaching for security and project leads
  • Culture change in IT organisations

Physical security and building systems

  • Security concepts for buildings, server rooms and data centres
  • Access control concepts and security zoning
  • Planning, selecting and integrating intruder alarm, detection and CCTV systems
  • Integrating these systems into incident processes and the ISMS
  • Resilience measures under the German KRITIS Umbrella Act (KRITIS-Dachgesetz)

An initial conversation, no obligation

Tell us where you stand: what requirement is coming up, what deadline is looming, what is already in place. You will get an honest assessment of how much work really lies ahead.

kontakt (at) dojokun.de

In confidence, with no commitment.