Light falling into a narrow sandstone canyon

Cybersecurity · The belay chain

Security is a chain.
We check every link.

A climber is only as safe as the weakest link in her belay chain. Since NIS2, the same applies to companies – right down the supply chain and right up to senior management.

Arrange a call View services

The story

Every link counts – including the one at your supplier.

NIS2 makes cybersecurity a management responsibility. Implementing individual measures is no longer enough: risk management, reporting channels, contingency plans, suppliers and training have to work as a chain. We check every link, close the gaps and keep the system resilient for the long term with an ISMS.

When you need us

  • You are not sure whether your company falls under NIS2 – or is indirectly affected as a supplier.
  • Registration with the BSI is still outstanding or incomplete.
  • Your management wants to understand its liability risks and complete the mandatory training.
  • Your companies in several EU countries are subject to different national NIS2 laws – and headquarters needs a shared picture of the situation.
  • You are a financial entity and have to implement the requirements of DORA.
  • Security measures exist, but there is no documented ISMS that is actually lived.

What we offer

From scope assessment to ongoing operations.

Scope assessment & BSI registration

We check which regulatory framework and which category apply to your company and document the classification. Where BSI registration is required, we help compile the information and support you through the registration process.

Gap & risk assessment

Current state against the requirements of the BSIG or DORA, prioritised by risk.

Building an ISMS

Policies, processes, roles and evidence – based on ISO/IEC 27001 and suited to your size.

Incident reporting & contingency management

Reporting processes for significant security incidents, contingency and recovery plans, exercises.

Supply chain security

Identify and assess critical service providers and secure them contractually.

ISMS as a managed service

Our ISMS tool documents, reminds and reports – we run it with you for the long term.

Approach

How we reach the goal.

Clarify scope

Check sector, size and role – including the registration obligation.

Assess gaps

Gap and risk analysis with a prioritised action plan.

Close the chain

Implement measures, build the ISMS, train management.

Secure for the long term

Operations, evidence and continuous improvement as a managed service.

From our projects

Already delivered.

Selected projects by our teams – client names omitted for confidentiality. We are happy to discuss details in person.

Cybersecurity · European group

NIS2 scope clarified for a corporate group

Goal
Clarify for the German and Austrian companies of a European group which of them fall under NIS2 – and which obligations follow for management and IT.
Our role
Scope and sector analysis under the BSIG, analysis of operational, legal and regulatory responsibilities per company, NIS2 gap analysis, training for management and IT departments – coordinated with external legal counsel.
Result
Scope indications per company, a prioritised picture of the gaps and a blueprint for group CISO governance of the national subsidiaries.
Cybersecurity · Several clients

ISMS built at the client

Goal
Manage information security systematically – with an ISMS that suits the organisation.
Our role
Built the information security management system with roles, processes, policies and risk management – from the scope to the ongoing improvement cycle.
Result
An ISMS in day-to-day operation that manages responsibilities and risks in a traceable way.
Cybersecurity · Several clients

BSI IT-Grundschutz introduced

Goal
Implement information security according to a recognised German standard and make it demonstrable – using the BSI IT-Grundschutz methodology.
Our role
Introduction according to BSI Standard 200-2: structure analysis, protection requirements assessment, modelling with the modules of the IT-Grundschutz Compendium, IT-Grundschutz check and implementation plan for open requirements.
Result
Security measures in line with BSI IT-Grundschutz that can be demonstrated to auditors and supervisory authorities.
Cybersecurity · European group

Group CISO for the national subsidiaries in Europe

Goal
Centrally manage and monitor the NIS2 obligations of the national subsidiaries of a European mobility service provider – including in Germany, Austria, the Netherlands, Spain, Italy and Romania, each under national law.
Our role
Advising the parent company on setting up the group CISO function: governance model with roles and reporting lines, a common security framework aligned with national requirements, group-wide monitoring of implementation status. For the Austrian companies, MSC is registered with the competent authority as the official NIS2 officer: we prepare analyses and recommendations, coordinate the legal assessment and support implementation on an ongoing basis as a managed service. Decisions and accountability remain with the client, based on our recommendation.
Result
Governance that makes the national subsidiaries comparable – with a situation picture for group management and clear responsibility on the ground.
Cybersecurity · Managed service

NIS2 as a managed service

Goal
Provide lasting relief to companies that fall under NIS2 – without them having to set up their own information security staff unit.
Our role
Ongoing support by MSC: introduced and built a security framework based on CyberFundamentals (CyFun) 2025 and ISO/IEC 27001/27002; registered in the BSI portal as the client's official NIS2 contact, took over communication with the BSI, followed up NIS2 findings, coordinated internal NIS2 audits.
Result
Obligations kept in view for the long term – with MSC as the official contact towards the BSI. Overall responsibility stays with management – the work does not.
Cybersecurity · Telecommunications

Security zoning: data centres cleanly separated

Goal
Implement group-wide security policies on network segmentation in the German data centres of an international telecommunications group – with separate development, test and production environments in line with ISO/IEC 27001 (“Separation of environments”, “Segregation in networks”).
Our role
As technology security consultant, recorded, assessed and consolidated business and technical applications including zone information – shadow IT included; classified the results of consultations with business and technical units, incorporated network information and transferred everything into the solution design documents.
Result
A robust basis for separating environments and network zones – and a client who regularly commissions MSC with new security projects.

All references

Frequently asked questions

Answered briefly.

Not legal advice – but a clear assessment to support your decision.

More detail in our Insights:

Is my company affected by NIS2?

We clarify this in two steps – reliably and documented:

  • Scope assessment: Is your company active in one of the 18 sectors listed in Annexes 1 and 2 of the BSIG, and does it exceed the size thresholds – 50 or more employees, or annual turnover and balance sheet total of more than €10 million? For some entities the obligation applies regardless of size.
  • Sector assessment: Assignment to sector and sub-sector. This determines your category – particularly important or important entity, possibly operator of critical facilities – and which additional regulatory framework applies, such as the EnWG for energy, the TKG for telecommunications, DORA for finance or the EU Implementing Regulation for digital services.
What applies in Germany specifically?

NIS2 is not only contained in the BSI Act. The NIS2 Implementation Act (in force since 6 December 2025) amends several laws, and EU law comes on top:

  • BSIG: registration with the BSI, risk management, reporting of significant incidents within 24 hours, 72 hours and one month.
  • EnWG (Sections 5c–5e): energy networks and energy facilities – IT security catalogue of the Federal Network Agency.
  • TKG for telecommunications and other sector-specific laws, e.g. SGB V in healthcare.
  • EU Implementing Regulation 2024/2690: applies directly and with precedence to digital providers such as cloud, data centres, DNS and managed (security) services.
What role does management play?

Management must approve the risk management measures, oversee their implementation and take part in training regularly. Breaches of duty may result in personal liability.

How are NIS2 and DORA related?

DORA (Digital Operational Resilience Act) has applied since January 2025 as more specific law for the financial sector – for example for banks, insurers and investment firms as well as their critical ICT service providers. For these companies, DORA requirements take precedence over the NIS2 rules.

Do I need ISO 27001 certification?

Not necessarily. NIS2 requires effective measures, not a specific certification. An ISMS based on ISO/IEC 27001 is, however, a proven framework for meeting and demonstrating the requirements in a structured way.

Affected or not? We will find out.

An initial call is free of charge and without obligation. You describe the situation; we tell you honestly whether and how we can help.

Arrange a call +49 8151 95969-100