What does an ‘IT Security Assistance Program’ do and what is the ‘CEO Module’?

The topic of IT security is a matter for the boss and belongs on the management's desk, so we should also address it. That's why we deliberately chose to use non-technical language in the blog. For us as IT people, or for me, this was a shift towards simple, non-technical language, so that people who didn't grow up with IT can understand us. This is also something where we still face a challenge today, namely to develop our understanding of the target group to such an extent that we speak the language of our customers.

IT security is a holistic process that I cannot limit to a specific group of people, for example the administrators, but has many addressees. It starts at the very top with the management, then goes through divisional management and reaches the users at the very bottom. And with IT security, I have an issue throughout all levels. So here too, I have to present things in a way that is appropriate for my target group. The CEO has completely different IT security requirements and I have to work with him on completely different topics than the administrator or the user. That's why we have sorted the whole thing into packages, so that the company can select the respective packages for its needs.

The CEO module deals with strategic issues. Where should the company develop? How should the company shape this path? And then we inevitably come to the question: What does this mean in terms of investment? What does that mean in terms of operating costs? We usually have discussions on a strategic level and we do this in the CEO module. In the CEO module, we also provide support with budget planning for the strategy that we have agreed with him. In other words, we develop an IT security strategy that covers a three- to five-year horizon. The CEO module works with the company on the topic of IT security in order to provide the management with a degree of clarity and transparency at this point. What steps, what milestones do we want to achieve, what budget do I need for this? This is a roadmap, so to speak.

And the moment we work with a CEO on this, we realize that the loss of control that the managing directors have experienced up to that point disappears, because the roadmap is suddenly transparent for them and they can sort it accordingly. With our help, he can also monitor his progress.

That's right, it's a subscription. The subscription has the advantage for us that we can respond to the company. This is an issue that can't simply be dealt with in three or four days; we have a year's work to do. As a rule, companies submit their business plans in late summer and we have to work on them.

This means that we start the discussions in May so that we can prepare the figures for September. And once the data is in the business plan, I have to make sure that things are incorporated into the project plans for the following financial year or calendar year in October and November. That means I always have phases during the year where I have to go in, where we have to be there to make things happen. So I need the subscription in order to work strategically with the company, with the managing director here, on the topic over the course of a year, because he also has different phases throughout the year in which he needs my support.

At the moment, we mainly rely on our blog and our subscriber count is around 1,200 readers, which we have regularly. We've built that up over the years. And, of course, we're clearly focusing on Facebook because it's our target group. We reach our managing directors as our readers via Facebook. But we are also active on Instagram. Because the companies, i.e. the people who leave university today, may be buying from us in five years' time.

And I can't ignore this channel. And then, of course, it's also very important to make the IT brand known as an employer brand. And Instagram is the channel where we are currently addressing our future employees. And when we talk about channels, we are not yet on Twitter, but we will also be on Twitter in the medium term. Content creation is an ongoing process for us, just like it is in any editorial office. We have an editorial plan, we think about the topics that could be interesting. What interests people, what is well read? We also regularly check our access figures, what went well, what didn't go so well?

It's a process that we've developed over the years and where 2 to 3 people are currently involved in producing and publishing the relevant content. From time to time, we also advertise an article that has gone particularly well. We then also put a bit of budget into it. That works quite well.

The time has already come when some insurers are no longer offering insurance policies because they can no longer bear the risk. Because the amounts of damage are increasing and because the frequency is increasing. It is relatively difficult for cyber insurers to calculate and predict whether they will be able to cover the settlement with the premium they receive.

And this can be seen from the fact that insurers are constantly raising the bar under which they grant insurance cover. We have now reached the point where the insurance company says that if you have not implemented two-factor authentication and if you have not implemented the corresponding processes, if you have not implemented patch management and a whole host of other requirements, then you have a problem. Without fulfilling this catalog of requirements, you can no longer get an insurance policy.