IT Security Audit — BSI, GDPR and TISAX

When does an IT security review make sense?

For example, when customers or business partners ask for proof, when you want to assess your obligations under GDPR Art. 32, before taking out cyber insurance, after a security incident, or to prepare for TISAX.

• Law firms and tax advisors: client requirements for IT security
• Automotive suppliers: TISAX obligations toward OEMs
• Medical practices: IT security guideline under § 390 SGB V
• Companies covered by NIS2: demonstrate risk management

Three tiers — your choice

All three tiers use the same 68 criteria across 12 areas from BSI IT-Grundschutz, GDPR Art. 32 and TISAX. The difference is how closely they're checked: with the self-check, you rate yourself; with the remote and on-site review, I look at your systems personally.

• Self-check (€0): questionnaire in about 10 minutes, automated evaluation, PDF, and IT ID card
• Remote audit (€490 net): approx. 2 hours via video call with screen sharing — firewall, backups, Microsoft 365, user accounts — plus a written report and a wrap-up call
• On-site review (from €1,490 net, up to 20 workstations, plus travel): network, firewall, Wi-Fi, servers, backups, and workstations at your site, a conversation with the people in charge, and a detailed report
• Optional: penetration test after written authorization from management (quoted separately)

After the review: implementing the measures

The report isn't the end. On request, I'll implement the measures with you — from firewall configuration and two-factor sign-in rollout to staff training. Implementation is offered separately and billed by effort.