IT security officer: role, order and operational reality

The IT security officer, increasingly referred to in the standard and in the NIS 2 world as the information security officer (ISB), is the central role where technical risks, organisational obligations and the reporting line to management converge. Section 38 BSIG in the version of the NIS 2 Implementation Act requires essential and important institutions to have effective risk management, trained management and a verifiable reporting chain with a 24-hour early warning and a 72-hour follow-up report to the BSI. ISO/IEC 27001:2022 also requires documented ISMS responsibility, which in practice depends on the ISB.

The article describes the role without folklore cloaks. Which tasks are mandatory, which are practice, how does the ISB differ from the CISO, what is in a reliable appointment certificate, which suitability characteristics can be proven and which staffing models work in a medium-sized company that cannot hire its own senior security manager. The duties and the NIS-2 primer itself are not repeated here; the focus is on the operational reality of the role.

The IT security officer advises the management, coordinates the information security management system (ISMS), checks risks, plans internal audits, is responsible for training and controls the reporting path for security incidents. He doesn't run the IT department. He oversees the effectiveness and completeness of the measures that the CIO or CTO implements operationally. This separation protects the role from conflicting goals and is expressly required by clause 5.3 of ISO/IEC 27001:2022.

The distinction from the CISO is organisational, not content-related. In corporations, the CISO leads a team and manages global programs; The ISB sits in the individual facility and is responsible for the local ISMS, the NIS 2 obligations and the reporting line to the management of that facility. In medium-sized companies, both functions coincide in one person. Provable independence is important. It is possible to appoint the IT manager as ISB, but this creates a conflict of objectives that auditors answer with findings. CIVAC manages the role in the workspace as Information Security Officer with an appointment certificate, proof of suitability and configured reporting line.

An appointment certificate is more than just a letter on a letterhead. It contains the name and function of those appointed, date of appointment, scope (which institution, which locations, which subsidiaries), tasks in relation to the law and standards (NIS2UmsuCG, ISO/IEC 27001:2022, IT Security Act), obligation to report directly to management, freedom to issue instructions in the exercise of the appointed office, obligation to maintain confidentiality, obligation to undergo further training, minimum deployment time and commitment to resources. It is signed by both sides.

Suitability must be documented separately. Proof of specialist training (e.g. BSI-IT-Grundschutz practitioner, ISO 27001 Lead Implementer/Auditor), professional experience in a security environment, industry knowledge and proof of further training from the last two years is common. An auditor asks for these receipts, not business cards. The appointment certificate, signed, filed, verifiable. In the CIVAC Workspace, the appointment certificate, proof of suitability and the report protocols are versioned in a file, with a retention period and access log.

The tasks of an ISB can be divided into seven fields. First, risk management: inventory, assessment, treatment and effectiveness testing. Secondly, policies and guidelines: information security policy, access policy, crypto policy, supplier policy. Thirdly, controls: selection, declaration of applicability, effectiveness measurement according to Annex A of ISO/IEC 27001:2022 with 93 controls. Fourth, awareness and training: plan, implementation, quota, evidence. Fifth, incidents and notifications: triaging, 24-hour early warning, 72-hour follow-up notification, final report, lessons learned.

Sixth, supplier and third-party management: security requirements in contracts, assessments, reports. Seventh, reporting: regular report to management, management review according to clause 9.3 of ISO/IEC 27001:2022, event-related reports in the event of incidents. These seven fields are not an optional add-on, they are mandatory. Audit-proof, documented, NIS-2-proof.

The reporting line is not a formal detail, it is mandatory. According to Section 38 Paragraph 1 BSIG, the management bodies of essential and important institutions must approve the implementation of the risk management measures and monitor their implementation. This presupposes that the ISB reports regularly and as needed to the management, rather than mediating across three hierarchical levels. A shortened reporting route via the IT manager to management does not fulfil the obligation.

In practice, this means a reporting cycle of at least quarterly plus an event-related report in the event of incidents, serious findings or new obligations. The report contains risks, measures, open findings, audit results, training status and reports. CIVAC provides a template set for this report and logs the sending with a time stamp. This means that the reporting line is not only established, but also documented. Others run compliance like a filing cabinet. We run it like software.

Auditors check suitability on three points. Firstly, formal qualifications such as BSI-IT-Grundschutz practitioner, ISO/IEC 27001 Lead Implementer or Lead Auditor, TISP, CISSP or comparable. Secondly, professional experience, documented in your CV and references. Thirdly, proof of further training for at least two years. A person without ongoing training is not currently qualified within the meaning of the standard.

The training must cover topics that correspond to the obligations of the institution: NIS 2 implementation, ISO/IEC 27001:2022 changes, incident response, supply chain security, cloud security, data protection references. An accumulation of vendor webinars is not enough. CIVAC maintains the aptitude and training certificates in the workspace as part of the officer file and makes them available in the audit at the push of a button.

The ISB does not work in a vacuum. Four interfaces are central. Firstly, to the data protection officer: Security incidents involving personal subjects require a parallel report in accordance with Article 33 GDPR within 72 hours. Triaging must trigger both pathways simultaneously. Secondly, to the compliance officer: Violations of laws, contracts or internal guidelines are recorded in a common incident register.

Thirdly, to emergency and crisis management, including business continuity according to ISO 22301 and the requirements of Section 30 BSIG to maintain operations. Fourthly, on supplier control: The supplier auditor is based on the security requirements defined by the ISB. CIVAC bundles the four interfaces into one workspace so that an incident triggers the ISB path, the DSB path and the compliance register simultaneously. Deadline expires as soon as we become aware of it.

The order can be internal, hybrid or external. Internal means an employee of the facility with sufficient capacity and suitability. Advantage: deep in-house knowledge. Disadvantage: Conflicts of objectives if the person is also responsible for operational IT tasks, and bottlenecks during vacation or illness. Hybrid means an internal role plus external support for audits, training and representation. External means an appointed external person who completely manages the role.

The external variant has two advantages that are often crucial in practice. Availability of qualified people and independence from operational IT. CIVAC works in a dual model. Licence the workspace for your internal representatives, or have our representatives order it. The appointment certificate, the reporting path, the templates and the representation regulations are structured the same in both versions; the difference lies in the person who signs.

Costs and effort depend on size, industry and protection requirements. An important institution within the meaning of NIS-2 with 250 to 1,000 employees typically expects to use half a full-time equivalent to a full-time equivalent for the ISB role. An essential facility in the KRITIS environment is significantly higher. External providers charge either based on fixed packages or based on effort. What is important is not the hourly rate, but the service level for audits, incidents and reports.

The classic response time for external representatives is between two and six weeks for inquiries and orders. This range is inappropriate in the incident. CIVAC delivers a two business day service level for orders, templates and incidents and operates the platform under EU data residency. The auditor calls, the evidence is ready.

The IT security officer is a mandatory role that combines law, standards and management. The appointment, suitability, independence, reporting line, scope of tasks and interfaces are non-negotiable; Only the staffing model is negotiable. Anyone who manages the role internally needs a platform that binds receipts and establishes reporting channels. Anyone who manages it externally needs a person with qualifications and a tool that opens the file to the auditor.

CIVAC works as a compliance platform and officer-as-a-service. The workspace maintains appointment certificates, proof of suitability, 490 audit templates, 93 ISO/IEC 27001:2022 controls and the 24/72 reporting path to the BSI under EU data residency. Licence the workspace for your internal representatives, or have our representatives order it. Turn reading into an assignment. Write to info@civac.de or use the contact form on civac.de.