Cyber security has become a contract question, not an IT question. We record the actual state of your websites, shops and servers, sort the findings by risk, and implement the measures.
Three steps that build on each other. The first one can be booked on its own, and that is where most companies start. This page goes further than the short version on the home page.
We record what is actually there, including the systems nobody has on a list any more.
We close the gaps in the order the audit put them in, at a time you set.
We check that the work held, and we stay reachable when a customer asks you for proof.
Neither of them names your website. Both of them reach it through the company that buys from you.
IACS UR E26 and E27: for ships contracted for construction on or after 1 July 2024 the classification societies require demonstrated cyber resilience. E26 covers the vessel as a whole, E27 covers the individual computer based systems on board, which is where equipment suppliers and their subcontractors come in.
NIS2: the German implementation act came into force on 6 December 2025 and puts around 29,500 companies in 18 sectors under the supervision of the BSI. Securing the supply chain is one of the named duties, so a company in scope has to secure its own suppliers and service providers. That is how the requirements arrive at a firm that sits well below the thresholds itself, usually as a security questionnaire from its largest customer.
Both were security mandates, not web projects.
Melitta: three years of group security work. Hundreds of websites and thousands of services audited, Cloudflare Enterprise rolled out across the brand domains, and servers hardened against the CIS benchmarks. On top of that came secured build pipelines, a content security policy across every web property and regular penetration tests.
Oldenburgische Landesbank: a gap analysis against ISO 27001 and BSI IT-Grundschutz during a bank acquisition. Several thousand control points assessed line by line, evidenced and prepared for the audit, together with the technical documentation, monitoring and the incident response plan.
An audit ends in documents you can hand on, not in a verbal summary.
Every finding with what it is, what someone could do with it and how likely that is. The order is the risk, so the first page is the one worth reading first.
Each measure with the work it takes and what it costs, split into what we do and what your own people do. You decide what gets done and in which order.
What was checked, what was changed and when it was verified, written so it goes straight into the next security questionnaire.
Directly, most likely not. Around 29,500 companies fall under the German act, as a rule from 50 employees or 10 million euro in turnover. Indirectly it reaches much further, because a customer in scope has to secure its own supply chain and passes the requirements on by contract. In practice that shows up as a security questionnaire from your largest customer.
No. We read, we scan from the outside and we look at configurations. Nothing is switched off and nothing is changed while the actual state is recorded. Changes belong to the hardening step, at a time you set, and each one has a way back.
A first audit of a website, a shop and the server behind them takes a few days. Larger estates take longer, mostly because of how many systems nobody has a list of. You get the number in writing before anything starts.
It does not. Most of what an audit turns up is work for the people who run your systems every day, and the report is written so they can pick it up. Where you want us to do a part ourselves, we do it and hand back the documentation.
No, and nobody should promise that. A certificate is issued by an accredited body or a classification society. What we do is the work in front of it: the gap analysis, the technical measures and the evidence trail, which is the part that usually takes the longest.
You get a written estimate before you commit, based on how many systems are in scope. No retainer is attached to it, and an audit does not oblige you to have the measures done by us.
Tell us what is in scope and you get a written estimate for the audit. If it is easier to talk it through first, take a slot.