Observe
Recognise business impact.
Executive Cybersecurity Leadership · Strategy · Transformation
Cybersecurity leadership for decisions with operational consequences.
Matthias Totzauer supports boards, executives and IT/OT leaders in industrial, critical-infrastructure and regulated organisations—personally, discreetly and through effective delivery.
Frame your situation →
Two clear paths · local in your browser · no registration
Confidential first conversation →
CISSPCISMCISAISO 27001 Lead AuditorISO 22301 Lead Auditor
Decide
Clarify options and residual risk.
Mobilise
Activate owners and resources.
Embed
Steer demonstrable progress.
15+Years in IT and security
C-LevelReporting and decisions
IT + OTGovernance through delivery
DE / ENInternationally deployable
One clear entry point
What do you need to frame with confidence?
Choose the path that matches the question in front of you. Both assessments stay at management level, provide immediate orientation and lead into professional validation only when useful.
- No registration
- Processed locally
- No automated decision
02
When pressure becomes real
The leadership constraint
More tools do not solve a leadership problem.
The constraint is often not missing technology, but unclear accountability, competing priorities and decisions without a shared risk picture.
Leadership Gap
A CISO vacancy, unclear roles or a programme without dependable leadership.
Regulatory Pressure
Prepare for NIS2, critical infrastructure, customers or external assessments.
Technical Exposure
Prioritise findings, transformation and dependencies for decision.
Operational Resilience
Connect critical services, recovery and leadership capability.
Executive engagement architecture
Clear remit.
Clear accountability.
Three clearly defined engagements for three leadership situations. Scope, accountability and fees are agreed only after professional qualification.
Decision mandate · 2–3 weeks
Executive Cyber Decision Sprint
Move from cybersecurity uncertainty to a defensible management decision and a prioritised 90-day plan.
Decision outcome
You receive a decision package with standalone value, whether or not a follow-on engagement is commissioned.
Programme design · 6–8 weeks
Cyber Resilience 100-Day Blueprint
Turn disconnected activities into an approval-ready cyber-resilience programme with a target model, budget logic and clear governance.
Decision outcome
Executives, finance and technology leaders receive one aligned basis for budget, resource and delivery decisions.
External security leadership · defined term
Fractional CISO & Cyber Transformation Office
Personally led cybersecurity governance and disciplined programme direction without prematurely building a full-time internal CISO structure.
Decision outcome
Management gains accountable leadership, a dependable steering cadence and transparent decisions instead of an open-ended activity list.
No clear engagement shape yet?
The Decision Navigator structures the trigger, business impact and leadership need—without registration or an obligation to make contact.
Open Decision Navigator →Four engagement fields
From decision need to an effective engagement.
01↗
Security Leadership
Interim CISO
- Mandate, accountability model and decision cadence
- Executive situation report with prioritised risks and dependencies
- 90-day agenda with owners and decision requirements
02↗
Regulatory Readiness
NIS2 & Critical Infrastructure
- Executive readiness picture and prioritised gaps
- Accountability and decision model
- Requirement-to-control-to-evidence structure
03↗
Secure Transformation
IT/OT Security
- Executive-ready IT/OT risk and dependency picture
- Prioritised security target state with transition paths
- Decision papers for identity, segmentation and access
04↗
Operational Resilience
Cyber Resilience & BCM
- Prioritised critical services and recovery objectives
- Executive incident and escalation model
- Recovery dependencies, gaps and exercise agenda
What management receives
Decision capability, not activity reporting.
Situation report
A shared view of business-relevant risk, obligations and dependencies.
Decision papers
Clear options with consequences, residual risk, resources and decision authority.
Prioritised agenda
A realistic 90-day sequence and the strategic steps that follow.
Leadership model
Owners, cadence, escalation and evidence for traceable progress.
Traceable competence
Evidence before self-promotion.
Qualifications and engagement profiles are stated precisely. Client names, testimonials and project metrics appear only with explicit approval.
Years across IT, security leadership and regulated environments
Recognised qualifications across security, governance and assurance
Lead Auditor qualifications for information security and resilience
Leadership from executive governance through operational delivery
Personal accountability
Peer-level leadership.
Depth when it matters.
Matthias Totzauer supports executives, IT and security leaders when accountability, risk and delivery must be clarified at the same time.
Lead Auditor certifications are personal qualifications. ITCST does not provide independent certification audits.
Executive Insights
Perspective for better decisions.
Focused analysis of security leadership, regulation, IT/OT and resilience—from the decision-maker’s perspective.
Interim CISO, fractional CISO or permanent hire: which model fits?
Effective CISO support depends on the mandate. Urgency, leadership need, decision rights and the intended outcome determine the right model.
Read article →NIS2 across corporate groups: separating scope, accountability and evidence
A group-wide security model does not remove entity-level obligations. NIS2 readiness needs clear accountability, dependencies and evidence.
Read article →Securing OT supplier remote access: governance before technology
Remote maintenance is necessary in many industrial environments. Without controlled identities, approval, segmentation and monitoring, it becomes a critical attack path.
Read article →Confidential first conversation
Which decision can no longer remain open?
In 25 minutes, clarify the decision need, urgency and engagement fit directly with Matthias Totzauer.