Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Germany · Austria · Switzerland
Manual penetration testing and security consulting scoped against the frameworks DACH organizations actually get assessed on, BSI IT-Grundschutz, BSI C5, and FINMA's operational resilience circular, not a generic international template.
309,000 new malware variants a day, tracked by BSI.
Germany's Federal Office for Information Security logs that volume of new malware daily in its own state-of-security report.
BSI, The State of IT Security in GermanyGermany, Austria, and Switzerland share a lot of security culture but not a single regulatory framework. Germany's Federal Office for Information Security (BSI) anchors both IT-Grundschutz, its baseline ISMS methodology, and the C5 catalogue for cloud providers. Switzerland runs its own track, FINMA's Circular 2023/1 for regulated financial institutions, and the Swiss NCSC as the national reporting point for cyber incidents. Austria, alongside Germany, is transposing the EU's NIS2 Directive on its own national timeline. A generic penetration test report doesn't map cleanly onto any of these, what does is testing scoped from the start with the specific country and framework in mind.
For organizations with EU-wide obligations layered on top of country-specific ones, this pairs directly with our EU / NIS2 & DORA compliance page.
This runs on the same manual, adversary-emulated methodology behind our core Penetration Testing service, applied with DACH-specific frameworks and reporting expectations in mind.
The country-specific baselines and regulatory expectations our DACH engagements are most often scoped around.
Germany's Federal Office for Information Security's baseline protection methodology for information security management, compatible with ISO/IEC 27001 and widely referenced across German public and private sector organizations.
BSI, IT-GrundschutzThe Cloud Computing Compliance Criteria Catalogue, published by Germany's BSI, specifying minimum security requirements for cloud service providers and giving customers a structured way to evaluate a provider's security posture.
BSI, C5 CatalogueThe Swiss Financial Market Supervisory Authority's fully revised circular on operational risks and resilience, covering ICT risk, critical data handling, and cyber risk management for Swiss-regulated financial institutions.
FINMA, cyber risk dossierSwitzerland's National Cyber Security Centre, the federal competence centre for cybersecurity and the reporting point for cyber incidents affecting Swiss businesses and critical infrastructure operators.
Swiss NCSCBSI & FINMA, evidenced
An IT-Grundschutz baseline gap, a BSI C5 logging shortfall, and a FINMA third-party risk finding , across three regulators, one engagement.
Baseline protection check, module SYS.1.1 (server)
$ ssh-audit db-prod.demo-corp.de
SSH: password authentication enabled, root login permitted
Fails IT-Grundschutz SYS.1.1.A3 (secure authentication baseline).
An illustrative walkthrough of how an engagement actually runs, not footage from a real client environment.
Yes, for organizations building or maturing an ISMS aligned with IT-Grundschutz or ISO/IEC 27001, we can structure testing and reporting to support that framework, though formal IT-Grundschutz certification runs through BSI's own accredited pathway.
We can scope technical testing that supports a C5 readiness effort or complements an existing C5 attestation, particularly around the technical control areas a penetration test naturally overlaps with, a full C5 attestation itself requires an accredited auditor.
Yes, we scope engagements for Swiss-regulated financial institutions navigating FINMA Circular 2023/1's operational resilience and ICT risk expectations, and can structure findings to support that context.
We work with clients across Germany, Austria, and Switzerland, engagements are remote-capable, with on-site work scoped where genuinely needed, regardless of which of the three countries you're in.
Talk to us about scoping an engagement around your specific regulatory context, BSI IT-Grundschutz, BSI C5, or FINMA.
