IT security consulting and ISMS
Implementation and operation of ISMS based on BSI IT-Grundschutz and ISO 27001, with protection requirements assessment, risk analysis and action plan for public authorities and state administrations.
AI-generated
Industry
Public Administration & Ministries
IT consulting with procurement experience on both sides
Public authorities, state administrations and municipal IT service providers work under conditions that private-sector organizations rarely face: procurement law, political steering, budget limits and growing pressure from NIS2 and BSI requirements. We know this environment as consultants, as project managers and as general contractors in EU-wide tender procedures.
Excerpt of services
Secure, compliant with procurement law, workable.
We work on both the contracting authority and the bidder side. That is why we know the requirements for service specifications, evidence and steering from both perspectives.
DevSecOps and Secure SDLC
Security across the entire software development process: CI/CD hardening, SAST and DAST, threat modeling and secure code reviews following BSI recommendations.
NIS2 and BSI compliance
Gap analysis, action planning and implementation support for public authorities and public IT service providers, with verifiable results for the supervisory authorities.
Procurement advisory and tenders
Support for public contracting authorities in IT procurement under VgV, UVgO and GWB, from the service specification to the evaluation matrix.
IT strategy for public administrations
Target picture, principles and roadmap taking into account OZG requirements, political objectives and budgetary realities.
Interim CIO, interim CISO and PMO
Executive functions on a temporary basis in public authorities and public IT organizations, with experience in political coordination processes and supplier management.
01
Plan
Protection requirements and threat modeling
02
Develop
Secure coding and code reviews
03
Build and test
SAST, dependency scanning and DAST
04
Deploy
Hardened configuration and release
05
Operate
Monitoring and vulnerability management
Schematic illustration. Checks run automatically in the pipeline, results feed into the ISMS.
Project examples
Reference excerpt, anonymized for good reason.
Mandates in public administration are subject to special confidentiality: the security architectures of state administrations and ministries are security-critical information within the meaning of the BSI Act (BSIG). In many cases, a public reference would breach the confidentiality agreements with the contracting authorities.
STATE MINISTRY · FEDERAL STATE · NDA
ISMS implementation and BSI IT-Grundschutz certification
Project management and overall professional responsibility for an ISMS based on BSI IT-Grundschutz for a state ministry with subordinate authorities, in a consortium with a specialized BSI audit partner. Protection requirements assessment for more than 120 IT procedures, risk analysis, policy framework and coordinated implementation across three authorities. Steering of all consortium partners and consistent reporting to the client.
STATE ADMINISTRATION · SEVERAL MINISTRIES · NDA
IT strategy and digitalization roadmap
Lead consulting responsibility for a cross-departmental IT strategy of a state administration with more than 15,000 users, in an extended project network with specialist advisors from law, organization and infrastructure under the overall steering of INTAC. As-is analysis, target picture, prioritized measures and governance model. Advice at CIO level, direct coordination with the State Chancellery and the Ministry of Finance.
FEDERAL AUTHORITY · NDA
NIS2 readiness and compliance evidence
Overall project responsibility for the gap analysis and NIS2 implementation at a federal authority with tasks close to critical infrastructure, together with a legal expert and a specialized audit service provider as consortium partners. INTAC coordinated all workstreams, prepared the complete evidence dossier for the supervisory authority and managed the coordination with the BSI contacts.
The project profiles are fully anonymized. We provide named references with contact persons confidentially on request as part of tender procedures.
Related services
Cybersecurity & IT Security
ISMS, NIS2 and KRITIS compliance, DevSecOps and security architecture.
Learn moreIT Strategy & Transformation
Target picture, gap analysis and roadmap, through to implementation support.
Learn moreResponsible AI
Use cases, governance under the EU AI Act and enablement of your teams.
Learn moreWe know public contracting authorities as consultants and as bidders.
Get in touch: discreet, direct, straightforward.