Services

Our focus is information security, regulatory requirements and data protection. Beyond that we take on interim leadership, outsourced roles such as CISO or Data Protection Officer, project and procurement management, organisational design and training – wherever they are decisive for the success of your security work.

Information security, regulation and data protection

Each topic on its own, or as a single joint programme: an ISMS to ISO/IEC 27001 or IT-Grundschutz carries much of the DORA, KRITIS and data protection requirements – if it is designed with them in mind from the outset.

ISO/IEC 27001 and BSI IT-Grundschutz

Information security management system

Establishing, operating and certifying an ISMS – to ISO/IEC 27001, to Germany's BSI IT-Grundschutz, or as ISO 27001 certification on the basis of IT-Grundschutz.

  • ISMS design, implementation and continual improvement
  • Gap analysis against ISO/IEC 27001 and 27002
  • IT-Grundschutz: basic, core and standard protection; security concepts for public authorities
  • Security architectures for business applications (incl. the Swiss federal modelling method)
  • Technical and organisational measures for processing classified information (VS-NfD, German RESTRICTED)
  • Physical security within the ISMS: access control, intrusion and hazard detection, video surveillance, server rooms – under ISO/IEC 27001 Annex A and IT-Grundschutz (INF modules)
  • Risk analysis and risk treatment
  • Certification preparation and audit support
  • Internal audits
  • External Information Security Officer (CISO)

DORA

Digital operational resilience in the financial sector

Implementing DORA's requirements for ICT risk management, incident reporting, resilience testing and third-party risk – for financial entities and their ICT service providers.

  • DORA gap analysis and implementation planning
  • ICT risk management framework
  • Control catalogues and implementing controls in the second line of defence
  • Managing ICT third-party risk and contractual requirements
  • Controls and audits of your ICT service providers
  • Processes for incident reporting and resilience testing
  • Preparation for supervisory reviews

KRITIS and NIS2

Compliance evidence for critical infrastructure operators

Preparing for and supporting the KRITIS compliance audits required under Section 39 of the German BSI Act, and implementing the obligations arising from NIS2.

  • Audit preparation and compliance evidence under Section 39 BSIG
  • State of the art and sector-specific security standards (B3S)
  • Attack detection systems (SzA): design and assessment
  • NIS2 applicability analysis and implementation roadmap
  • Reporting processes and registration

Data protection

GDPR and the Swiss Data Protection Act

Data protection built into your information security rather than bolted on beside it: from gap analysis to ongoing support as your external Data Protection Officer.

  • GDPR gap analysis and implementation
  • External Data Protection Officer (TÜV-certified)
  • Records of processing and data protection impact assessments
  • Data processing agreements, contracts and third-country transfers
  • Swiss Data Protection Act (FADP) for companies with operations in Switzerland
  • Technical and organisational measures integrated with the ISMS

We speak the language of everyone involved

A security or regulatory initiative has three languages: that of management, which wants to know about risk, cost and timing; that of IT operations, which knows the systems, interfaces and configurations; and that of the lawyers in the legal department or law firm, who examine and interpret the requirements. What usually fails is not the implementation but the communication in between.

We translate in all three directions. For the lawyers, this means: they know the law, but rarely the standards it refers to, the IT-Grundschutz compendium, the sector-specific security standards or the system landscape in which the requirements take effect. We determine applicability and scope, establish the technical baseline, translate requirements into controls, processes and evidence, and prepare the results so that they can be assessed legally. For management and IT operations, it means: you receive the requirements translated into decisions and work packages rather than paragraphs of legislation.

The legal assessment itself stays where it belongs: with your lawyers, with whom we are happy to work directly. Legal services within the meaning of the German Legal Services Act (Rechtsdienstleistungsgesetz) are not part of what we offer.

Additional services

Interim management and outsourced roles

  • External CISO / Information Security Officer – interim or ongoing
  • External Data Protection Officer – interim or ongoing
  • Interim head of IT, architecture or change
  • Health checks and forensic reviews of troubled major projects
  • Project and programme recovery and oversight

Projects, programmes, procurement

  • Project and programme management to HERMES5, PRINCE2 and agile methods
  • Setting up and running project management offices (PMO)
  • Public procurement: WTO/EU tenders, specifications, contract templates
  • Independent assessments of cloud services: security, data protection, risk, strategic fit

Organisation and sourcing

  • IT strategy and governance: rules, processes, structures
  • Demand and supply organisation, IT service catalogues
  • Service management to ITIL and ISO/IEC 20000
  • Restructuring, outsourcing, pre- and post-merger

Training and coaching

  • Training in ITIL, ISO/IEC 20000, HERMES5 and IT security (TÜV/EXIN trainer)
  • Coaching for security and project leads
  • Culture change in IT organisations

Physical security and building systems

  • Security concepts for buildings, server rooms and data centres
  • Access control concepts and security zoning
  • Planning, selecting and integrating intruder alarm, detection and CCTV systems
  • Integrating these systems into incident processes and the ISMS
  • Resilience measures under the German KRITIS Umbrella Act (KRITIS-Dachgesetz)

An initial conversation, no obligation

Tell us where you stand: what requirement is coming up, what deadline is looming, what is already in place. You will get an honest assessment of how much work really lies ahead.

kontakt (at) dojokun.de

In confidence, with no commitment.