Interim CIO/CDO for PE portfolio companies, the upper mid-market, corporate groups and divisions

When the deadline is set and IT is not ready

NIS2, DORA, CRA, the EU AI Act and SAP ECC end of maintenance are dated obligations of the management.

Gain clarity on working together in 20 min You need support You need a specific outcome

Situation

The legal duty stays with the management. What is needed is IT leadership that translates deadlines into delivery, reporting readiness and board reporting – alongside day-to-day operations.

For whom

Management and executive board
Supervisory board
CFO
CISO and compliance as functions

What I take on

I implement the obligations in the line: clarify applicability and roles, set up the programme, manage providers, deliver evidence for auditors and regulators, report to management and supervisory board.

What is in place in your situation after 30, 60 and 90 days

Day 30Applicability assessed
Applicability, gaps and deadlines are assessed; the programme plan is approved by management and supervisory board.
Day 60Responsibilities and reporting channels in place
Responsibilities, reporting channels and programme governance are in place; providers and integrator are managed.
Day 90Ready to evidence to auditors
Implementation runs with evidence for auditors and regulators; board reporting is established.

Services

NIS2 & KRITIS – governance and reporting readiness

Deadline: Management duties under section 38 BSIG; reports after 24 hours, 72 hours and 1 month; Austria: registration under NISG by 31 Dec 2026

What I take on

Registration, risk management, reporting process, management training, board reporting. Certifications with partners.

Evidence

Security roadmap with NIS2 requirements across 140 sitesARTEMIS, 2025–2026
Critical-infrastructure outages down to 0Alliance Healthcare, 2023

DORA in the financial sector

Deadline: In force since 17 Jan 2025

What I take on

Implementation of the management body’s duties: ICT risk management, management of ICT third-party providers, incident reporting and resilience testing – in the line, with reporting to the board and regulators.

Approach

Gap analysis in weeks 1–4, action plan, phased implementation with evidence.

Security leadership for a limited period (interim CISO)

Deadline: After an incident or audit finding

What I take on

Security leadership until a CISO is on board: maturity level, roadmap, organisation, selection and onboarding of the CISO. Certifications and audits with partners.

Evidence

CISO and ISO 27001 build-up initiated after a cyber incidentARTEMIS, 2025–2026

ERP & S/4HANA programme leadership with master data

Deadline: SAP ECC maintenance ends 31 Dec 2027 (extension to 2030); 54% of users still on ECC; S/4HANA programmes on average 30% longer than planned

What I take on

Programme governance, platform, hosting and licences, master-data governance before migration, management of integrator and business units.

Evidence

SAP S/4HANA platform for the consolidation of 17 ERP systems and 25 charts of accounts, including master-data governanceCarrier, 2025
SAP R/3 consolidated onto SAP S/4HANA, 187 SAP services bundledGazprom Germania, 2017–2018

CRA – product and OT security

Deadline: Reporting duties for manufacturers since 11 Sep 2026

What I take on

Clarify which products are affected, build the vulnerability and reporting process, define responsibility between IT, OT and product development.

Approach

Applicability analysis in weeks 1–4, then build-up with specialised partners.

AI from pilot to operations – CDO for a limited period

Deadline: EU AI Act: 2 Dec 2026 and 2 Dec 2027

What I take on

Prioritisation of AI initiatives, ownership and governance, works agreements, transfer into operations – on request as CDO or AI lead for a limited period.