Industry
Insurance, Reinsurance, Energy
Project
IT Security & Risk Advisory Services
Duration
Multiple engagements (project durations ranging from 2–12 months)
Strengthening IT Security, Risk Governance, and Compliance in Regulated Industries
Challenge
In the context of increasing regulatory scrutiny and digital transformation, several clients from the insurance and energy sectors required support to improve their IT security governance, internal control systems, and compliance with regulatory standards. The challenges ranged from building a risk management methodology, auditing IT environments, and managing third-party security risks, to implementing structured frameworks aligned with ISO 27001, BSI standards, and sector-specific regulations such as DORA.
Our Approach
We supported a globally leading German insurance group in designing and presenting a comprehensive risk management model (ICS). This included developing a process methodology, creating templates for risk assessments, and coaching individual business units through risk evaluation and internal control documentation.
In parallel, we conducted IT audits for both insurance and reinsurance companies. These audits focused on the assessment of General IT Controls, technical and functional validations of archiving solutions, and GAP analyses of legacy versus new data environments. Audit results were documented in standard tools and presented to IT leadership for remediation planning.
In the energy sector, we led the workstream for service provider management within an IT security initiative. This involved assessing current measures, analyzing dependencies between technical activities, and defining a robust framework for secure provider governance—aligned with ISO 27001 and BSI standards.
Additionally, we supported clients in reviewing and applying DORA (Digital Operational Resilience Act) requirements and conducted internal security assessments for new digital services, ensuring alignment with financial sector compliance standards.
Results & Impact
Our work enabled clients to align their IT security and risk management practices with internal and external compliance requirements, while also improving operational maturity. Risk management frameworks were formalized and adopted across departments, audit findings were addressed efficiently, and third-party security governance was elevated to meet industry best practices. Regulatory readiness was significantly improved, especially in light of upcoming DORA enforcement.
Key Success Factors
Success was achieved through deep regulatory knowledge, structured documentation and communication, and a practical understanding of both business and technical environments. Our ability to bridge methodology with implementation ensured buy-in from stakeholders across IT, compliance, and operations.
Relevant Services
- IT Security & Compliance Management
- Internal Control Systems (ICS)
- IT Audit & Risk Assessment
- Provider & Third-Party Risk Management
- DORA Readiness & Regulatory Alignment
