Skip to content

Protect

IT compliance: security you can prove

Compliance is not paperwork chaos for us, but provable technology: we check your IT systems against GDPR, NIS2, ISO 27001 and industry regulations, close gaps in the technology (access, logging, deletion) and document what auditors care about. Focus: IT compliance, GDPR support, NIS2, ISO 27001 and BSI basic protection for IT systems in the mid-market.

Request a first call How we work

What is included

  • Gap check: current state vs. requirements (GDPR, NIS2, ISO 27001) with prioritisation
  • GDPR support: DPA templates, deletion concepts, access logic, record of processing
  • NIS2 readiness: inventory, risk assessment, reporting processes, technical measures
  • ISO 27001: building the ISMS, policy foundations, audit preparation
  • Technical evidence: logging, permission concepts, change management – anchored in the technology
  • Industry compliance: health (medical device software), finance, industry – gap-based

Who this service is for

Mid-market whose operations run on IT

20–500 employees whose production, sales and service depend on servers, network and Microsoft 365 – where every outage costs real money.

Teams without a full IT department

IT is a side job for one or two people, the knowledge sits in heads and 24/7 coverage is missing. We take over operation, monitoring and support.

Companies with sites in DACH + internationally

One IT architecture and one security baseline across Berlin, Zurich, London and other sites – measured in a single report, backed by one SLA.

How the delivery runs

  1. 01

    Audit & target picture

    We document hardware, network, software, cloud and security – and measure where outages, risks and costs sit today. The result: a shared target picture and a prioritised roadmap with numbers.

  2. 02

    Build in milestones

    Implementation in clearly prioritised stages – each with a measurable goal. You always see what is going live, what it delivers and what comes next.

  3. 03

    Operation & continuous improvement

    Monitoring, support, patch and security management then run as an ongoing operation. Monthly reporting with clear KPIs – availability, response times, costs – no black box.

Typical starting situations we solve

These patterns keep coming up in our audits. If one of them fits, a conversation is almost always worth it.

Servers and network have been running on their own for years – nobody knows what depends on what and what is patched.

Backups exist, but nobody knows if they work – a restore has never been tested.

Microsoft 365 is licensed, but MFA, permissions and data protection remain unresolved – often until an incident makes them visible.

Shadow IT and single tools grow alongside the core system – without integration, without a security standard, without a budget overview.

What we deliver – concretely

Measurable KPI roadmap

Clear goals per milestone – from availability to response time. We name the KPIs that should change before we start.

GDPR, consent & data hygiene

Compliance is part of every setup: consent, deletion concepts, clean data – no retrofitting after the data-protection audit.

Documentation & handover

Everything documented: setups, workflows, logic. Your team can keep working independently after the collaboration – no lock-in.

Frequently asked questions

As a mid-market company, do I have to implement NIS2?

If you operate in one of the affected sectors (energy, transport, healthcare, finance, digital infrastructure, public administration, e-commerce above a certain size) – yes, with phased deadlines from 2025. We check the classification and build the technical evidence so it is audit-ready immediately.

Do you also do the data protection impact assessment (DPIA)?

Yes, technically: we deliver the technical description of the processing, the measures, the risks and the mitigations. The legal assessment and approval stay with the data protection officer – we deliver what he needs for the DPIA, clean and complete.

What does IT Compliance & Data Protection cost with Core IT Services?

It depends on scope, tools and data quality. In the first call you get a concrete range and a milestone roadmap – no strings attached. Ongoing operation is available as a monthly package, projects as a fixed price.

How quickly will we see first results from IT Compliance & Data Protection?

Usually after 4–8 weeks, depending on the starting point. In the audit we define the KPIs that should change, and we report monthly and transparently – what is better, what is unchanged, what is worse.

Do you work with our existing tool stack?

Usually yes – we are tool-agnostic. If an existing tool makes sense, we keep it; if not, we advise on switching. Partner discounts do not drive recommendations.

Do we need dedicated staff on our side for this?

One contact person for decisions is enough. We handle build and operation and document everything, so your team can continue independently after the collaboration.

Are you set up for international markets (e.g. Italy, Spain, the UK)?

Yes. We are based in Berlin and operate sites across DACH, the UK and Europe with one team and one systems architecture – reporting in one currency: your KPIs.

Do you also run the ongoing operation, or just the setup?

Both is possible. Many clients start with the setup and take over the operation themselves afterwards – we document and train. Others let us run the whole operation. In the first call we say honestly what serves you better in your situation.

How do you handle legacy systems and existing data?

We start with an inventory audit: what is usable, what needs to be cleaned up, what can be retired. Legacy systems are mapped and migrated where it is worth it – not blindly. You start clean, without inheriting debt.

IT Compliance & Data Protection: Let us calculate what it is worth for you

30 minutes, no strings. We look at your numbers and show where the lever is.

Request a call

30 minutes, no strings. No pitch – we look at your data.