Information Security Strategy

Start with a maturity assessment: Where do you stand today? Which regulatory requirements apply to you? Which risks are most critical? On this basis, we prioritize measures and develop a roadmap with quick wins and strategic milestones. ADVISORI offers a structured introductory workshop that creates clarity within 2–

3 days.

The industry standard is 5–10% of the IT budget for information security. For the initial strategy development and establishment of foundational structures, you should plan for 50,000–200,

000 EUR — depending on company size and maturity level. What matters is not the absolute amount, but the right prioritization: it is better to implement a few measures properly than to pursue everything simultaneously in a half-hearted manner.

This depends on your industry, size, and regulatory situation. ISO 27001 is the international gold standard and universally recognized. BSI IT-Grundschutz is particularly suitable for German companies, KRITIS operators, and public authorities. NIST CSF is a good complement for companies with US operations. TISAX is mandatory for automotive suppliers. In practice, we often recommend ISO 27001 as a foundation with industry-specific additions.

NIS 2 requires, among other things: systematic risk management, incident reporting within 24/72 hours, supply chain security, business continuity management, cryptography concepts, and regular training. Particularly relevant: senior management is personally liable and must participate in training. An ISMS based on ISO 27001 already covers the majority of these requirements.

ADVISORI is itself certified to ISO 27001, ISO 9001, and ISO

14001 — we practice what we advise. With around

150 consultants and project experience in banking, insurance, industry, and the public sector, we know the industry-specific requirements first-hand. We do not deliver generic slide decks, but pragmatic solutions that hold up in audits and work in day-to-day operations.