Contact
Whether regulator, EU client or insurer: the question of evidence will come. Better to answer it yourself first. Briefly describe your situation and I will get back to you personally.
For Boards of Directors, Executive Management, Heads of IT & CISOs · Switzerland and the EU
Risk assessment, penetration testing, regulation and crisis response for Boards of Directors, Executive Management, Heads of IT and CISOs – independent of software and product vendors, confidential, under NDA on request. Through your EU subsidiary, as a supplier to a regulated client or as an IT service provider to a bank: NIS-2 and DORA reach Swiss companies faster than most board minutes suggest.
Acute security incident? Emergency contact →Playing the video loads it from YouTube (Google), which transmits data to Google. More in our Privacy Policy.
Trusted at the highest level
WHO IT’S FOR
Cyber risks do not land with IT alone. Each role needs a different answer – and all of them need the same evidence.
Responsibilities, risk appetite and reporting lines set up so that the Board of Directors can evidence its duty of care (CO Art. 716a).
Under NIS-2, the early warning to the authority is due within 24 hours. By then it must be clear who decides and what is protected first.
Identify vulnerabilities and attack surfaces and prioritise them by business impact – in IT and OT.
Test whether your defences hold in an emergency, and prepare the results so that they stand up before regulators and clients.
The situation
Switzerland is no special case as soon as an EU client, an EU subsidiary or a regulated principal is involved. Three risks then land not with IT, but at the boardroom table.
Liability and law
NIS-2 requires management bodies to approve and oversee cybersecurity risk-management measures (Art. 20). For essential entities, fines reach up to €10 m or 2 % of total worldwide annual turnover (Art. 34). Anyone who cannot prove they paid attention bears the risk personally.
Lost business in the supply chain
Art. 21 NIS-2 and Art. 28 to 30 DORA oblige regulated clients to assess their suppliers and bind them contractually. Those who cannot provide the evidence are not rejected at the next tender – they are not even invited.
Standstill without a BIA
The early warning to the authority is due within 24 hours (Art. 23). Without a Business Impact Analysis, you will not know in that time which processes must be rescued first, how long they may be down and who decides.
You don’t repaint the funnel of a sinking ship. You check whether there are enough lifeboats – before you cast off.Check whether you are affected now
SERVICES · ASSESSMENT AND TESTING
Your company assessed through the eyes of an attacker – and the findings translated into decisions for Executive Management.
Threats, vulnerabilities and impacts on your critical processes assessed – linked to the Business Impact Analysis.
Outcome: risk picture and prioritised action plan.
Controlled attacks on networks, applications and systems – within the agreed scope and with written authorisation.
Outcome: findings with ratings and recommendations, plus a summary for Executive Management.
Red Teaming plays a realistic attacker, Blue Teaming strengthens detection and defence. Together they show whether your defences hold in an emergency.
Outcome: attack paths, detection gaps, improved procedures.
Comprehensive analysis of your attack surface and vulnerabilities, prioritised by business impact.
Outcome: prioritised list of vulnerabilities.
Where do you use AI, which data flows, who decides? Risks such as data leakage, manipulation and a lack of governance are assessed.
Outcome: AI risk profile and governance recommendations.
Production, control and building technology: identifying risks without jeopardising operations.
Outcome: OT risk picture and action plan.
Scope, methods and deliverables are agreed for each engagement.
Request an assessment →CRISIS RESPONSE
Whether ransomware or data leakage: support for your crisis management team with decisions, notifications and recovery.
Lead decisions, communication and notifications to the authorities in a structured way. NIS-2: early warning within 24 hours. Switzerland: reporting of cyberattacks on critical infrastructure to the Federal Office for Cyber Security (BACS) within 24 hours.
Coordinating initial measures, steering recovery according to the priorities of the Business Impact Analysis, and supporting coordination with authorities and communication.
Crisis playbooks for ransomware, supplier failure, data leakage and blackout. Tabletop and command-post exercises for the crisis management team.
Call directly: +41 78 880 98 48
REGULATION AND STANDARDS
Preparation for audit, assessment and certification – pragmatic and documented so that it stands up before regulators and clients.
Determining applicability, gap analysis against Art. 21, training of management bodies under Art. 20.
Implementation for financial entities and ICT third-party service providers, management of third-party providers.
Preparation for the TISAX assessment in the automotive supply chain.
Preparation for certification of the information security management system.
Business continuity management, Business Impact Analysis and contingency planning.
Establishing and exercising the crisis organisation.
Reporting process for cyberattacks on critical infrastructure.
Operational resilience in the financial sector.
Risk Control RCC supports preparation and implementation. Certifications and assessments are carried out by accredited bodies.
Check whether you are affected now →The entry offer
Within a few weeks, the NIS-2 Resilience Check answers the question that no one on the Board can answer with certainty today: Are we affected, where do we stand, and what needs to be done next? It consists of two modules that build on each other.
You find out definitively whether and in what role NIS-2 or DORA covers your company – directly, through an EU subsidiary or as a supplier.
A gap analysis against the requirements of Art. 21 that shows where your organisation stands today – and what a regulator or client would see first.
We discuss scope and terms in the first conversation. Confidential, under NDA on request.
SERVICES · LEADERSHIP AND GOVERNANCE
Governance sets the direction, implementing NIS-2 and DORA provides the evidence, and the Business Impact Analysis carries you through an emergency. I bring all three together so that they do not end up as three separate projects.
Governance as an instrument of leadership and protection
Responsibilities, risk appetite and reporting lines are set up so that the Board of Directors and Executive Management can evidence their duty of care (CO Art. 716a).
Pragmatic, for regulated companies and suppliers
Requirements are translated into measures that suit your organisation and documented so that they withstand scrutiny by regulators or clients.
The foundation of true resilience
Critical business processes, their dependencies and tolerable downtimes are identified. From this follow priorities for protection, recovery and investment.
Why Risk Control RCC
Large law firms deliver legal opinions, system integrators deliver tools. In between, the question of how a company actually acts in an emergency remains unanswered. That is exactly where I work.
| Large law firm | System integrator | Risk Control RCC | |
|---|---|---|---|
| Focus | Legal interpretation | Technology and products | Management responsibility and operational crisis practice |
| Outcome | Opinions and memoranda | Implemented solution | Demonstrable programme with action roadmap |
| Independence | High | Tied to own portfolio | Independent of software and product vendors |
| Point of contact | Changing teams | Project manager | Me personally, with experts from my network |
Managing Director, Risk Control RCC GmbH
30 years of experience in governance, risk & compliance, business continuity and crisis management. Professor of business, studied at Stanford and in Vienna, keynote speaker. Behind Risk Control RCC stands a network of experienced senior experts, whom I assemble according to the task.
What matters is not predicting the future, but being prepared for it.Attributed to Pericles
The approach
We clarify whether and how you are affected, and measure your status against the requirements. Outcome: gap analysis and a basis for decision for the Board of Directors.
We identify your critical processes and their dependencies and derive a prioritised roadmap from them. Outcome: you know what must be protected first and what it costs.
Measures, responsibilities and reporting lines are embedded in your organisation and practised together. Outcome: a programme that runs day to day and holds in an emergency.
The best players are of no use if the team has not trained to play together with discipline. Resilience is an exercise, not a document.
Start with step 1VIDEO
The essentials in a few minutes: applicability, management’s obligations and the path to demonstrable compliance.
Playing the video loads it from YouTube (Google), which transmits data to Google. More in our Privacy Policy.
The objections
NIS-2 applies to entities within the EU. You are nonetheless affected if you operate an EU subsidiary, provide services in the EU or, as a supplier to a regulated client, must meet its supply-chain requirements. The same applies to DORA for financial entities and their ICT service providers. The qualification establishes definitively whether, and in what role, this applies to you.
It is a good foundation, but rarely sufficient. ISO 27001 or ISO 22301 cover many requirements, but not automatically the responsibility of management bodies, the reporting deadlines or supply-chain management under Art. 21 NIS-2. The Resilience Check shows what you already meet and where specific gaps remain.
Scope and duration depend on the size, structure and supply relationships of your company. In the first, non-binding conversation I will give you a clear framework before you commit.
On request, we work under NDA from the outset. I work independently of software and product vendors and do not pass any data on to third parties. Any experts from my network who are brought in are likewise bound to confidentiality.
