Cybersecurity · Information Security · Automation
Less manual follow-up. Current evidence. Clear accountability. We connect your security systems and processes, from technical findings to management decisions.
Matthias Totzauer · Advisory, development, integration and agreed operational support
Three choices for initial guidance
The automation finder suggests a focused starting point. No registration. Your choices are processed only on this page and are not stored.
Your suggested starting point
Initial guidance. Feasibility, access, licences, effort and approvals are assessed before implementation. Your selections are not automatically transferred to the contact form.
01 / Cybersecurity
We integrate existing tools and build the missing connections. Every workflow has an owner, defined inputs and an explicit failure path.
Combine system data from existing sources, assign ownership and expose gaps.
Reconcile devices, software, protection status and owners; raise tickets for missing assignments.
Asset register with data freshness, source and exception history.
OT queries and new data sources are agreed with operations first.
Turn scanner findings into prioritised tasks with owners, deadlines and effectiveness checks.
Link findings to assets and criticality, reduce duplicates, create tickets and schedule validation.
Traceability from finding to confirmed remediation.
Patch approval, maintenance windows and rollback stay within change management.
Enrich alerts and turn repeatable handling steps into documented playbooks.
Retrieve context, correlate related reports, assign cases, track deadlines and prepare summaries.
Playbooks with case history, escalation and measurable handling time.
Account suspension, isolation and blocklists have explicit approval and exception rules.
Coordinate joiners, movers, leavers and recurring access reviews end to end.
Route requests, collect approvals, trigger defined tasks and escalate overdue reviews.
Access evidence linking request, approval, execution and confirmation.
Business approvals, privileged access and emergency accounts are handled explicitly.
Compare agreed security baselines with the actual environment on a recurring basis.
Report configuration drift, missing protection, expiring certificates and failed jobs.
Visibility into deviations, exceptions and agreed fixes.
Automatic remediation follows testing, scope limits and agreed authorisation.
Structure reported-email handling and simplify feedback to reporters.
Capture reports, query approved context sources, assign cases and prepare status updates.
A consistent reporting and handling process with traceable decisions.
Quarantine, deletion and mail-rule changes follow defined authorisation.
02 / Information Security
Make recurring governance work predictable with sources, ownership, deadlines and professional approval. Integrate with existing ISMS and GRC tools.
Move recurring information-security work from spreadsheets and reminder emails into dependable workflows.
Request evidence, collect it from approved sources, track due dates and initiate policy reviews.
Control register with owners, sources, review dates and version history.
Evidence and control effectiveness require professional review; a green status is not certification.
Connect risks and actions to operational status and keep decision-makers informed.
Consolidate action status, escalate overdue tasks and prepare source-linked metrics.
Risk register, action overview and recurring executive reporting.
Risk assessment, risk acceptance and budget decisions stay with named owners.
Coordinate supplier and service-provider security reviews throughout the relationship.
Route questionnaires, collect evidence, track expiry dates and trigger reassessment.
Supplier register with review scope, open actions and next review date.
Exceptions, risk approvals and contractual decisions require professional judgement.
Coordinate training, acknowledgements and recurring awareness activities.
Assign audiences, send invitations and reminders, and track completion and content versions.
Overview of assigned training, deadlines and evidence.
Privacy, employee representation and permitted reporting are agreed before rollout.
Bring backup status, recovery tests and exercises into ongoing management.
Report failed backups, schedule restore tests, track actions and request emergency-contact reviews.
Evidence of backups, tests, deviations and open actions.
Successful backups do not replace restore tests; production recovery remains a controlled decision.
Connect product security with engineering, vulnerability handling and support.
Import component inventories and SBOMs, route advisories, record approvals and track support periods.
Product-specific evidence from components to vulnerability handling.
CRA scope, conformity and external reports are reviewed and approved by responsible people.
An illustrative workflow
An example adapted to your data quality, responsibilities and tools. Errors, missing responses and exceptions are explicitly escalated.
From selection to operation
We start with one bounded process and measurable objectives. Further workflows build on a dependable foundation.
Document the process, data, owners, failure cases and intended value.
Agree access and approvals. Configure integrations and develop missing components.
Test realistic cases, duplicates, failures, rollback and acceptance criteria.
Provide documentation, monitoring, ownership and agreed support arrangements.
Process model and responsibilities, agreed configuration or source code, interface documentation, access model, test and acceptance records, error monitoring and an operating guide. We agree metrics upfront, such as handling time, overdue tasks, evidence age or manual steps.
Possible environments include Microsoft Sentinel, Defender, Entra ID, Microsoft 365, Azure, Wazuh, GLPI, Topdesk, Jira and existing GRC tools. Actual connections depend on APIs, licences, data quality and approved access.
Usually the starting point is the existing landscape. We assess what can be connected, where data is missing and where a focused application makes sense.
The permitted actions are defined per workflow. Collecting and reporting can be automated, while consequential actions can require approval. Production changes need tested rules, scope limits and a recovery path.
Where useful, AI can assist classification, summaries and drafts. Data destinations and confidentiality are agreed first. Outputs are checked; risk acceptance, conformity and critical changes stay with responsible people.
No. Automation supports the ISMS and evidence preparation. Assessing effectiveness, legal requirements and certification remains a separate professional task.
We agree ownership, monitoring, update handling and support before handover. Ongoing operational support is available within an expressly agreed scope; a 24/7 SOC is not implicitly included.
ITCST is based in Wunsiedel, Bavaria. We support organisations in Germany and across Europe, remotely and on site by agreement, in German and English.
Your next step
Tell us the process, the systems involved and the current bottleneck. Together, we define a useful first engagement.
Technical reference points: NIST · Continuous Monitoring · Microsoft · Security Orchestration & Automation