Cyber Security Governance

NIS 2 makes cybersecurity a matter of personal responsibility for senior management — in the literal sense. Management must approve risk management measures, monitor their implementation, and participate in cybersecurity training. Failure to comply may result in personal liability. Fines can reach up to EUR

10 million or 2% of global annual turnover. In Germany, NIS 2 is expected to affect 25,000–40,

000 companies — significantly more than the previous IT Security Act.

A Virtual CISO (vCISO) is an external security expert who assumes the role of Chief Information Security Officer on a part-time basis. This model is particularly worthwhile for mid-sized companies (100–2,

000 employees) that require qualified security leadership but cannot or do not wish to invest in a full-time salary (typically EUR 120,000–180,

000 per year). ADVISORI provides vCISOs with an average of 15+ years of experience.

The Three Lines of Defense model separates operational responsibility, oversight, and independent review: The first line (IT operations, business units) implements security measures. The second line (CISO Office, risk management, compliance) defines standards, monitors compliance, and reports to senior management. The third line (internal audit) independently reviews effectiveness. This model is standard in regulated industries and is explicitly required by BaFin and the ECB.

The most important KPIs for board-level reporting are: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) for response capability, patch compliance rate for technical hygiene, phishing simulation results for employee awareness, open critical vulnerabilities with SLA adherence, and the overall maturity level against the target framework. ADVISORI recommends a maximum of 8–

10 KPIs, presented quarterly in an executive dashboard.

A foundational governance framework with roles, committees, and core policies can be established within 3–

4 months. Full implementation including the KPI framework, board reporting processes, and the Three Lines of Defense model typically takes 6–

12 months. For urgent NIS 2 action requirements, we offer a fast-track program: within

8 weeks, the legally required minimum standards are covered — including mandatory training for senior management.

Not necessarily. What matters is that the governance function is staffed and independent. For smaller companies, a vCISO combined with external security monitoring may be sufficient. From approximately 1,

000 employees, we recommend an internal CISO Office with at least 2–

3 FTEs. ADVISORI supports the build-up — from the job description through recruiting to onboarding — and bridges the interim period with our vCISO service.