Security that fits your
organization's reality —
and stays that way.
Many security architectures emerge reactively — a tool here, a policy there. We design the target architecture for your cloud security: structured, audit-ready for TISAX and DORA, and with a concrete implementation plan — including an initial DORA gap analysis for FinTech companies. We accompany implementation directly — no handoff to subcontractors.
Thinking architecture in layers
A resilient security architecture addresses all levels of your infrastructure — from identity to governance.
Each layer is individually assessed, designed, and integrated into a coherent overall picture.
Who this is for
Security Architecture is for organizations that want to think beyond the next step in their cloud security — and need a target architecture that holds up.
After an Assessment
You have completed a Cloud Security Assessment and want to address the identified vulnerabilities in a structured way — with a coherent target architecture instead of isolated measures. For automotive suppliers, we offer an initial TISAX Readiness Assessment to quickly identify the concrete action required.
Cloud Migration
You are migrating workloads to the cloud or introducing a hybrid Microsoft Azure environment and need to set up the security architecture correctly from the start — so no gaps arise that could jeopardize a future TISAX or DORA audit.
Regulatory Obligations
TISAX, DORA, NIS2 or ISO 27001 require a documented security architecture. Whether automotive supplier with OEM requirements or FinTech under BaFin supervision — we deliver the architecture and the audit-ready documentation.
Zero Trust Transition
You want to transition your existing Microsoft environment to Zero Trust and need a structured implementation plan — one that fits your regulatory obligations and is defensible internally.
What we deliver
We don't design theoretical concepts — we deliver architectures that can be implemented in your environment.
Target Architecture Document
Description of the target architecture with decision rationale, technology choices, and delineation from existing systems
Implementation Plan
Prioritized roadmap with work packages, dependencies, and realistic timelines
Risk Assessment
Documentation of addressed and residual risks — comprehensible for internal reviews and external auditors
Technical Specifications
Concrete configuration requirements for Entra ID, Intune, Defender, Sentinel, Azure Policy and more
Implementation Support
We support your team during implementation — as a technical sparring partner or directly in the configuration
Architecture Review
Regular review of the implemented architecture against the target specification — so deviations are identified and corrected early
Three-phase approach
Every architecture is tailored to the specific situation of the organization. We work in a structured yet pragmatic process.
- 01
Current State Analysis
1–2 weeks- Inventory of the current environment
- Capture regulatory obligations
- Understand strategic goals
- Use assessment report as foundation
-
- 02
Target Architecture Design
2–3 weeks- Technology selection and integration points
- Develop target architecture
- Iterative alignment with your team
- Delineation from existing systems
-
- 03
Documentation and Handover
1 week- Complete architecture documentation
- Implementation plan with work packages
- Joint handover session
- Clarify open questions
-
Approximately 4–6 weeks to a completed target architecture
Each phase builds on the previous one and delivers standalone value.
Technologies and approaches
Most of our clients in Automotive and FinTech run Microsoft Azure and M365. That is why our deepest expertise is there — and we use it for what it is: the pragmatically best tool for these environments.
Zero Trust
Zero Trust architecture based on Microsoft Entra ID, Intune, Defender and Sentinel
Data residency in Azure
For FinTech companies and critical infrastructure operators, we design cloud architectures with data residency in Microsoft Azure — EU Data Boundary, German data centers. A real differentiator that we implement ready for production.
Hybrid Environments
Hybrid environments with on-premises integration and clear security boundaries
IAM
Identity and access management as the foundation of the security architecture
Compliance
Compliance-ready architecture for NIS2, DORA, ISO 27001, BSI IT-Grundschutz
Security Monitoring
Monitoring architecture with Microsoft Sentinel, Defender XDR, and structured alerting as the foundation for ongoing operations
Frequently asked questions
Who is liable under NIS2 when a security incident occurs?
Executive management. NIS2 obliges management bodies to approve risk management measures, oversee their implementation and undergo training. That responsibility cannot be passed to IT or to a service provider. The only mitigating factor is evidence that due diligence was applied: documented decisions, implemented measures and demonstrated effectiveness.
What does DORA require of an exit strategy for ICT providers?
DORA requires that a financial entity can change provider in an orderly way, or bring the service back in house, without endangering operations. In practice that means documented architecture, access to your own data and configurations at any time, and operation inside your own tenant rather than on a provider's proprietary platform.
What does data residency in Azure mean in practice?
The EU Data Boundary keeps customer data and most processing within the EU, and German regions additionally allow the data centre location to be chosen. This does not replace a legal assessment of third-country access, but it covers what many supervisory requirements ask regarding storage location and processing.
Schedule a Security Architecture consultation
Tell us briefly about your current situation — we'll get back to you within one business day for an initial conversation. Personal, reliable, no detours.
No obligation. No sales pitch. Just clarity.