Anchoring security as a leadership responsibility
NIS2 enshrines personal liability of senior management for cybersecurity — with fines of up to EUR 10 million or 2% of global turnover.
Cyber security governance goes beyond an ISMS: it defines how cybersecurity is anchored, steered, and monitored at board level. Under the NIS2 Implementation Act (Section 38 BSIG), board members and managing directors must personally approve security measures, actively monitor their implementation, and face personal liability for breaches of duty. Delegation alone does not protect — only demonstrable governance structures provide relief.
Our expert consultants provide comprehensive cyber security governance services tailored to your organization's specific needs. We combine deep regulatory expertise with practical implementation experience to deliver measurable results.
5 service modules
Bookable individually or as an end-to-end programme.
Development of a comprehensive governance structure with defined roles (CISO, Security Officer, Data Protection Officer), committees (Security Board, Risk Committee), and reporting lines. We implement the Three Lines of Defense model and ensure clear accountability from operational IT to the board.
Not every organization immediately needs a full-time CISO. Our vCISO service provides you with an experienced security expert as an external CISO — with dedicated capacity, board reporting experience, and immediate availability. Ideal for transitional periods, under NIS2 pressure, or as a permanent model for mid-sized companies.
Senior management needs decision-relevant security information, not technical details. We develop a KPI framework with metrics such as MTTD, MTTR, vulnerability exposure, compliance score, and risk heat maps — presented in quarterly board reports that fulfill NIS2 documentation obligations and enable strategic decision-making.
Development of a hierarchical policy framework — from the overarching information security policy through topic-specific policies (access control, incident management, business continuity) to operational work instructions. All policies are NIS2-compliant, ISO 27001-aligned, and tailored to your organization — not off the shelf.
The NIS2 Directive explicitly requires senior management to approve cybersecurity measures and monitor their implementation. We support you in meeting these requirements: mandatory training for senior management, documentation of governance decisions, establishment of the required reporting processes (24-hour initial notification, 72-hour update), and evidence management.
6 phases
Structured development of your Security Governance — from analysis to ongoing operations.
Evaluation of existing structures, roles, and processes against best practices and regulatory requirements
Definition of the governance structure with roles, committees, reporting lines, and the Three Lines of Defense model
Development of the hierarchical policy framework from the overarching guideline to the operational work instruction
Development of security metrics and board-ready dashboards for data-driven management
Training for senior management (NIS2 obligation), security teams, and business units
Go-live of governance processes, initial board reports, and continuous optimization
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
Contact our specialists today for a personalized assessment of your requirements.
6 QUESTIONS, BRIEFLY ANSWERED
NIS2 makes cybersecurity a matter of personal responsibility for senior management — in the literal sense. Management must approve risk management measures, monitor their implementation, and participate in cybersecurity training. Failure to comply may result in personal liability. Fines can reach up to EUR 10 million or 2% of global annual turnover. In Germany, NIS2 is expected to affect 25,000–40,000 companies — significantly more than the previous IT Security Act.
A Virtual CISO (vCISO) is an external security expert who assumes the role of Chief Information Security Officer on a part-time basis. This model is particularly worthwhile for mid-sized companies (100–2,000 employees) that require qualified security leadership but cannot or do not wish to invest in a full-time salary (typically EUR 120,000–180,000 per year). ADVISORI provides vCISOs with an average of 15+ years of experience.
The Three Lines of Defense model separates operational responsibility, oversight, and independent review: The first line (IT operations, business units) implements security measures. The second line (CISO Office, risk management, compliance) defines standards, monitors compliance, and reports to senior management. The third line (internal audit) independently reviews effectiveness. This model is standard in regulated industries and is explicitly required by BaFin and the ECB.
The most important KPIs for board-level reporting are: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) for response capability, patch compliance rate for technical hygiene, phishing simulation results for employee awareness, open critical vulnerabilities with SLA adherence, and the overall maturity level against the target framework. ADVISORI recommends a maximum of 8–10 KPIs, presented quarterly in an executive dashboard.
A foundational governance framework with roles, committees, and core policies can be established within 3–4 months. Full implementation including the KPI framework, board reporting processes, and the Three Lines of Defense model typically takes 6–12 months. For urgent NIS2 action requirements, we offer a fast-track program: within 8 weeks, the legally required minimum standards are covered — including mandatory training for senior management.
Not necessarily. What matters is that the governance function is staffed and independent. For smaller companies, a vCISO combined with external security monitoring may be sufficient. From approximately 1,000 employees, we recommend an internal CISO Office with at least 2–3 FTEs. ADVISORI supports the build-up — from the job description through recruiting to onboarding — and bridges the interim period with our vCISO service.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance