Information Security · NIS-2 · ISMS
Information Security Consultant
I work on the practical implementation of regulatory requirements, especially NIS-2, ISO/IEC 27001, TISAX and BSI IT-Grundschutz. My focus is on solutions that also work under the real conditions of mid-sized companies.
Featured talk
At the BSI's German IT Security Congress, I presented results from my follow-up study on implementation barriers, evidence and standardised self-assessment. The contribution was nominated for the Best Student Award.
Speaking
Research findings and practical experience for professional audiences, companies and the security community.
Why the same “Yes” in an assessment can carry very different levels of confidence, and how to test the evidence behind it.
Four-hour workshop: participants act as the assessment team and test the NIS-2 claims of the fictional company Musterwerk 180 against synthetic evidence.
Results of the second research phase on NIS-2 implementation in German SMEs.
Barriers, approaches to solutions and the role of standardised self-assessment.
Insights from outreach to 1,800 SMEs and 17 expert interviews.
Early experience from implementation, and where companies are currently stuck.
Practice and research
NIS-2 self-assessment for SMEs
This Excel-based maturity model grew out of my empirical research. It distinguishes between implementation and evidence, helps prioritise gaps and maps requirements to established standards.
Research
Methodology, results and development of the NIS-2 project, split into the first study and the follow-up.
Qualitative study with 17 expert interviews, comparison with established security standards and development of the first self-assessment model.
View project page →Descriptive survey with 18 usable questionnaires and six in-depth interviews on resources, evidence and implementation practice.
View research archive →Media
Articles at HvS-Consulting (in German)
Contact
On NIS-2, information security management and the practical implementation of regulatory requirements.