Information Security Management : simple, strategic, sustainable

The development, implementation, and optimization of digital business models is becoming increasingly essential for many companies as a key component of their competitive advantage. It requires new capabilities to ensure the security of complex IT infrastructure, which forms the foundation of all business areas.

Traditional IT security strategies often focus on processes and tools. 

‘Modern IT security places people at the center of the action, aiming to optimize IT security awareness.’

In agile organizations, significant productivity improvements are possible. We operate entirely agile to provide these benefits to our customers in terms of speed and quality in our services.

With Security-as-a-Service (SECaaS), we offer our capabilities and best practices in pragmatic service packages as a monthly subscription. This allows companies to book individual IT security services with us or completely outsource their IT security needs.

At the beginning of each Security-as-a-Service engagement, we start with a personalized service onboarding. During this process, we discuss specific challenges with you, share activities already undertaken and document your individual expectations of us.

Subsequently, potential services from our service catalog are discussed and linked to your challenges to find solutions.

Key components of our service include emergency preparedness, complete overview, network security, data backup, updates, password + cryptography, system security, user management, security mindset, training, logging / time synchronization, infrastructure security, best practices, and compliance.

Regarding the Future of Hospitals Act (KHZG), we are a certified service provider and are happy to assist you with the application and implementation of your project.

Overview | How are you positioned?

Have all critical data and processes been identified, and have corresponding protection needs been addressed? What are the IT security requirements, which measures need to be prioritized for implementation, and how is the roadmap and responsibility defined for them?

Emergency Preparedness | What to Do When an Emergency Occurs?

Are emergencies identifiable, and do plans for emergency preparedness and response exist? Are responsibilities defined, and are those responsible capable of taking action? Do you and your employees know what to do in case of an emergency? Are the most important procedures known?

Evaluation of Compromises | Do You Monitor for Intrusions in Your System?

Are attempted attacks and compromised systems reliably detected?

Security Mindset, Training & Security Awareness is Key.

What priorities have been set regarding IT security, and what focus is being pursued? What is the budget for IT security and related training? Which measures have been successfully implemented? Is there a knowledge portal, regular teasers, and effectiveness assessments to actively promote security awareness among all stakeholders?

Planning and Implementation – Planning is Half the Battle.

Within the framework of a risk analysis, identified measures are planned, and we support their implementation and execution.

Network Security

What processes and measures are in place to support network security? How are anomalies detected, communicated, and addressed?

Patch Management

Updates are crucial and require proper attention. 

What processes are in place for software maintenance and updates?

Data Backup – No Backup, No Sympathy

Are backups secure from deletion and manipulation over the network? Is restoration regularly tested?

Password + Cryptography | “123456” is Not a Password

What policies exist for passwords, (privileged) user accounts, 2-factor authentication, encryption (e.g., mobile devices)? How are these policies enforced?

System Security – Be Tough

What methodologies are used to harden systems?

User Management | Not Everyone Should See Everything

How is user management implemented, and what hierarchies, protective mechanisms, and processes are actively in use?

Logging / Time Synchronization

For investigating security incidents, seamless and accurate recording of log files is crucial. What methodologies and processes are in place for this purpose?

Infrastructure Security | EKG of the Infrastructure

Is there adequate protection for your IT systems against fundamental threats? How is appropriate access control ensured?

Compliance with Legal / Normative Requirements | §§§

Have the requirements of regulations such as the IT Security Act 2.0, BSI Basic Protection (BSIG §8a), ISO/IEC 2700x, Norm 62443, TISAX, KRITIS requirements, or B3S been fulfilled?

Implementation and Establishment of an ISMS

We support the implementation and establishment of an Information Security Management System (ISMS) following standards like ISO 27001.

Setting Up Security Monitoring | Knowing What’s Going On – Around the Clock

The implemented measures are integrated into monitoring to promptly inform stakeholders about incidents and report accordingly.

Support – You’re Not Alone, We’re Here for You

We, as service providers, plan and support the ongoing operation and necessary adjustments.

During the Service Onboarding/Anamnesis Workshop, we will establish the framework for your IT security, either in person where possible or via video conferencing if necessary. Essential requirements and priorities will be determined to ensure the success of our services and your IT security to the best possible extent. Additionally, we will discuss your wishes, challenges, and needs for a successful collaboration, all of which will be integrated into the service.

Our SECaaS team operates in an agile and digitally-oriented manner, allowing us to deliver high-quality service and work pragmatically with our clients.

In our service delivery, we utilize an NPS (Net Promoter Score) scoring system. This enables us to systematically understand your expectations and provide necessary suggestions for improvement.

If our service does not meet your expectations, we are willing to end the collaboration without any additional consequences for both parties and without harm. Through our transparent approach, we emphasize that there are no hidden costs involved. When you engage with us, you are booking your individual service package, and we will deliver the promised results.