Protecting information assets effectively
You are planning a new IT system or specialised application and need to have an information security concept created? You need clarity about requirements, risks and necessary measures.
With secuvera, you first clarify the right methodology and the scope you need. We then create, review or update your security concept. We include suitable existing documents.
Clarify requirements and scope of the concept together
Your situation
Your existing concept no longer matches the current system. A client demands evidence, or a review has revealed gaps. Perhaps you also lack the resources or the methodological experience for a new concept.
First you need clarity on which requirements apply and which systems and dependencies are involved. This determines whether a review, an update or a new concept makes sense. We clarify this with you and agree on a suitable methodology.
Services and results
You can commission each of the three services individually. Which analyses and steps are included depends on the applicable requirements, the systems in scope and the agreed scope of work.
Our approach
Depending on the engagement, you receive a coherent security concept, a standalone review report or a fully updated version of your concept. You do not need an existing ISMS (information security management system) for this.
Our work is based on our own processes, which we have been improving for many years. Within this approach, we choose the technical methodology to suit your task. Your responsible staff contribute their knowledge of systems and workflows.
You explain the reason for the project and the result you want. Together we clarify the regulatory, contractual and internal requirements. We then define the systems, processes and relevant dependencies in scope and agree the methodology with you.
Agreed project scope
The subject of the concept, the approach and the expected result are defined.
We take suitable information from your documentation as independently as possible. We then collect missing details in structured interviews and workshops. Your responsible staff from information security, IT and business units explain systems and workflows for this.
Usable information base
Usable earlier work and additional details are available for the analyses and assessments.
For a new concept, we develop the required analyses and measures. For a review, we assess existing content against the agreed criteria. For an update, we revise the parts affected by changes. Your responsible staff agree assessments with us and make the necessary decisions.
Assessed action needed
It is clear which measures are required and where decisions are still pending.
At the end, we document the results to suit the engagement: as a new concept, a standalone review report or an updated complete version. We record assessments and recommendations in a traceable way. Open risks and necessary decisions remain visible.
Your basis for decisions
With the document, you can plan measures, initiate improvements and justify security decisions.
We combine methodological and technical experience from security concepts for different organisations, IT systems and specialised applications. This allows us to compare requirements from regulations with the technical context of your environment.
We check existing system descriptions, protection requirements assessments, risk assessments and measure descriptions for suitability and currency. We adopt and supplement usable content selectively. This preserves work already done and avoids duplicate data collection.
For IT-Grundschutz, we select the modules to match the actual information domain. Binding requirements and relevant dependencies are still taken into account. If your task allows a leaner approach, we recommend it. Our recommendations are based on the security requirements and are independent of the sale of technical products.
Getting started
Describe the system, specialised application or information domain. Known requirements, existing concepts, system descriptions and findings from earlier reviews are helpful.
Name people from information security, IT and the departments concerned. They provide information and agree assessments with us. We take the necessary effort into account in project planning. Decisions on risks and measures remain with your responsible staff.
The security concept documents requirements, risks and measures. For it to result in protection, the necessary measures have to be implemented. A finished document alone does not ensure information security.
The engagement is a single project to create, review or update a concept. Optionally, we support you technically during implementation. Technical implementation and ongoing support are not part of the scope. We agree later reviews or updates as further projects; penetration tests can be commissioned separately.
Your responsible people provide information and make technical decisions. This responsibility cannot be transferred to us completely.
The requirements that actually apply determine the methodology. BSI IT-Grundschutz is not mandatory across the board. We take IT-Grundschutz, ISO/IEC 27001 and 27002 as well as customer and sector-specific requirements into account. If binding requirements allow it, a risk-based approach without commitment to a particular set of rules is also possible. ISO/IEC 27001 does not prescribe a universal structure for every security concept.
What matters are the defined systems, processes and their relevant dependencies. With IT-Grundschutz, we select the modules based on the actual information domain. This keeps the scope aligned with your task. Binding requirements remain taken into account.
The service is aimed at companies, public authorities and public bodies across all sectors. This includes KRITIS (critical infrastructure) operators, regulated companies, IT service providers and software manufacturers. Organisation size and ISMS maturity are not fundamental restrictions.
Possible subjects are organisations and information domains, specialised applications, IT procedures, infrastructures, networks and platforms. Cloud services and outsourced IT services are also possible. Complexity, protection requirements and the specific task are decisive. Typical contacts are information security officers, CISOs, IT managers, project managers and those responsible for specialised applications.
We evaluate existing documents and collect missing details in a targeted way. Your subject-matter owners explain systems and workflows, answer questions and agree assessments with us. The effort therefore also depends on the quality of your documents. The responsible people in your organisation make the decisions on risks and measures.
You receive a standalone review report with findings and recommendations. The existing concept remains unchanged. You can commission an update separately if you want it revised. If agreed, checks of how measures are actually implemented are part of the review engagement.
You receive a fully updated security concept. The affected content, analyses, assessments and measures are updated in it. A separate update report or a separate overview of changes is not a standard part of the engagement.
For a new concept, you can optionally agree a short or management summary that is neutral in terms of security. You can share it without disclosing security-critical details of the full concept.
Optionally, we support you technically in implementing the measures. We agree a later review or update as a separate project. You can commission additional technical testing separately as a penetration test. For ongoing support of your ISMS, there is the separate CISO as a service.
Tell us about the IT system or specialised application and the known requirements. Based on your starting point, we clarify the next step that fits: review, update or create from scratch.
