An information security officer ensures clear responsibilities, structured risk management and legally compliant processes for handling information. They analyze security gaps, coordinate protective measures across departments and monitor compliance with internal and external requirements. From implementing effective security policies to training employees, the ISO plays a central role in protecting sensitive data and systems.
Their goal: making information security measurable – through defined KPIs, documented measures and continuous security assessment within the company.
What does an information security officer do? – Responsibilities at a glance
An Information Security Officer (ISO) protects company-wide information against threats, vulnerabilities and outages. They are responsible for setting up, implementing and monitoring a systematic information security management system (ISMS). Their most important responsibilities include:
1. Developing and implementing an ISMS:
The information security officer introduces an information security management system (ISMS) based on recognized standards such as ISO 27001 or TISAX®. In doing so, they draw up comprehensive policies, procedures and guidelines that form the basis for effective information security. This is particularly important for structuring organizational processes and clearly defining responsibilities.
If the management system is not yet in place, the ISO's work usually starts with our ISMS consulting.
2. Monitoring and control:
Regular reviews and audits of information security measures are essential. The ISO ensures that legal regulations and internal security policies are consistently complied with. This continuous monitoring helps to identify potential vulnerabilities early and to respond in time. In addition, the security strategy is often based on the recommendations of the German Federal Office for Information Security (BSI), in order to keep pace with current standards and best practices in IT security.
3. Employee training and awareness:
Employee training is an essential part of the security strategy. The external ISO regularly runs training sessions to raise awareness of information security. These cover current threats, risks and best practices in order to foster a security culture within the company.
4. Risk analysis and risk management
The ISO identifies and assesses security risks that may affect the company. They develop tailored proposals for risk mitigation and implement both technical and organizational measures to improve the security posture.
Identifying, assessing and managing information security risks is of great importance. The ISO places particular emphasis on the confidentiality of data by proposing suitable measures to prevent unauthorized access to sensitive information. This includes both technical and organizational measures aimed at ensuring the integrity and confidentiality of company data.
5. Advising management:
As an advisor to company management, the external ISO provides valuable insights into all aspects of information security. They prepare detailed reports on the current security status and formulate recommendations for improving security strategies in order to strengthen the company's resilience. At management level, an external CISO complements the ISO — they are responsible for strategy, budget and reporting to management.
6. Supporting audits and certifications:
Consulting information security officers actively support companies in preparing for external audits and certifications such as ISO 27001. They accompany and coordinate the entire audit process so that all requirements are met.
7. Information security incident management:
An important aspect of the security strategy is the development of emergency plans and incident response processes. The ISO provides support in responding to security incidents, whether a data breach or a cyberattack, and ensures that the company can act quickly and efficiently.
8. Documentation & reporting
- A central area of responsibility of the information security officer is documenting and reporting all security-relevant activities. This ensures transparency, traceability and the continual improvement of the information security management system (ISMS).
The ISO regularly prepares:
-
Security reports: These reports document the current state of information security, identified vulnerabilities, audit results and the status of ongoing measures. They serve as the basis for management decisions.
-
Action plans: Following the risk assessment, the ISO defines specific measures to minimize risk, prioritizes them and sets deadlines and responsibilities.
-
Security policies and concepts: The ISO develops binding sets of rules, e.g. password policies, access policies or the overarching security concept. These documents form the rulebook for secure behavior within the company.
Through consistent documentation, the information security officer ensures that audits are passed, legal requirements are met and security objectives are pursued systematically.
If there is no internal capacity for these tasks, an external information security officer (in German) takes on the role — with a fixed allotment of hours instead of a full-time position.
These responsibilities as a ready-made control plan
54 controls mapped to ISO 27001 and TISAX®, with review cycle and owner — the Excel template an ISO uses to steer the year.
You will receive the download link by e-mail within a few minutes.
Information security in the company: legal requirements and competencies of an ISO
Below we give an overview of the key regulations and industries in which appointing an ISO may be necessary.
1. Critical infrastructure (KRITIS)
Since 6 December 2025, operators of critical facilities (KRITIS) have automatically been classed as particularly important entities under the new BSI Act (BSIG). They must implement measures in line with the state of the art, use attack detection systems and demonstrate implementation to the BSI every three years (Sec. 31 and 39 BSIG). These companies, which include sectors such as energy, healthcare, transport and finance, bear a special responsibility. Since a failure of their IT systems would have far-reaching consequences for society, they must ensure their IT security in line with the state of the art.
2. NIS2 Directive
The EU NIS2 Directive significantly extends security requirements – to around 29,500 companies and organizations in 18 sectors. This directive, which aims to improve the security of network and information systems, requires companies in certain industries to strengthen their IT security. In Germany, NIS-2 has applied since 6 December 2025 through the new BSI Act. It does not prescribe an ISO: management must implement and monitor the risk management measures and is liable for them (Sec. 38 BSIG). To meet this obligation, most companies appoint an internal or external ISO who steers implementation operationally. The NIS2 Directive affects a wide range of industries, from utilities and transport to communications and healthcare facilities.
3. Data protection (GDPR)
Although the General Data Protection Regulation (GDPR) primarily governs the processing of personal data, there are overlaps with the responsibilities of an ISO. Companies must appoint a data protection officer if, as a rule, at least 20 people are constantly involved in the automated processing of personal data, or if their core activities involve large-scale processing of sensitive data or large-scale monitoring (Art. 37 GDPR, Sec. 38 BDSG). In practice, data protection officers and information security officers often work closely together, especially when it comes to protecting data against unauthorized access or loss.
4. ISO 27001 and certifications
Companies that want to introduce an information security management system (ISMS) according to ISO 27001 or have one certified face the task of defining clear responsibilities for information security. Although the standard does not explicitly require the appointment of an ISO, in practice it makes sense to entrust one central person with managing and monitoring the ISMS. This person usually performs a function similar to that of an information security officer and helps to ensure security standards.
5. Industry-specific requirements
In particular industries, such as the automotive industry, additional security requirements apply that may make it necessary to appoint an ISO. One example is the TISAX® standard, which was developed especially for automotive suppliers to ensure information security for confidential data along the supply chain. In these cases, an information security officer helps to meet the requirements of the VDA ISA catalogue and to prepare the TISAX® assessment.
When is it necessary to appoint an information security officer?
Appointing an ISO is not a legal requirement for all companies. In practice, an ISO becomes necessary because the management of companies subject to NIS-2 must ensure and monitor the implementation of the measures (Sec. 38 BSIG), because industry rules (e.g. for banks and insurers under DORA, or for federal administration bodies under Sec. 45 BSIG) require such a function, or because ISO 27001 or TISAX® require clearly assigned responsibilities. Industry-specific standards such as TISAX® also lead some companies to appoint an information security officer. It is therefore advisable to review your own legal framework and industry-specific requirements carefully in order to avoid legal consequences and strengthen information security for the long term.
What qualifications should an information security officer (ISO) have?
An information security officer plays a key role in protecting company data and systems. To carry this responsibility effectively, they need a broad range of skills and experience. The following qualifications are essential to fill the role of an ISO successfully:
1. Professional qualifications of an ISO
Technical knowledge:
Information security officers need an in-depth understanding of IT security architectures, network security, encryption technologies and firewalls. They should also be familiar with operating systems, server technologies and cloud environments. This is necessary to identify vulnerabilities and take appropriate security measures.
Certifications:
Internationally recognized certificates in information security are particularly valuable for demonstrating competence. The most important include:
- ISO/IEC 27001 Lead Auditor or Lead Implementer: These certificates demonstrate sound knowledge of implementing and monitoring an information security management system (ISMS).
- CISM (Certified Information Security Manager): This certification focuses on the management side of information security and enables the ISO to develop security strategies.
- CISSP (Certified Information Systems Security Professional): A globally recognized certification covering technical and organizational aspects of information security.
- CISA (Certified Information Systems Auditor): This certification qualifies the holder to carry out audits in the field of information security.
Knowledge of legal regulations:
In addition to technical skills, a deep understanding of the legal framework is required. The information security officer must be thoroughly familiar with data protection laws such as the GDPR and know the industry-specific security requirements.
2. Professional experience
Experience in information security:
Several years of practical experience in various areas of IT or information security is essential. Ideally, the ISO has worked in different industries to gain a broad perspective on differing security requirements.
Experience with an ISMS:
An ISO should have demonstrable experience in implementing, monitoring and maintaining an information security management system (ISMS). This is particularly important for companies that are aiming for or already hold ISO 27001 certification.
Risk management:
The ability to identify security risks, assess them and develop appropriate risk mitigation measures is one of the core responsibilities of an ISO. This means recognizing threats proactively and closing security gaps before they become a problem.
3. Soft skills help with collaboration
Communication skills:
An ISO must be able to explain complex technical matters in an understandable way. Communication between the IT department and management is particularly important to ensure that security measures are clearly understood and supported.
Analytical thinking:
The ability to systematically identify potential security gaps and develop solutions is indispensable for successfully carrying out the ISO's responsibilities. This requires a high degree of analytical thinking.
Sense of responsibility and integrity:
Since the ISO is responsible for protecting sensitive data, a high degree of responsibility and integrity is indispensable. Companies must be able to trust that information security officers will act appropriately in crisis situations and always keep the company's security in view.
4. Industry-specific knowledge
Certain industries have additional information security requirements to consider. For example, ISOs in the automotive industry must be familiar with the requirements of TISAX®. In the financial sector, specific regulatory requirements play a central role. An ISO should therefore have sound knowledge of the relevant norms and standards in the respective industry.
5. Continuous professional development
Since the threat landscape in information security is constantly changing, it is essential for an ISO to take part in further training regularly. They should always be informed about the latest developments in IT security in order to ensure the effectiveness of the measures implemented and to identify new risks early.
The combination of professional expertise, experience and soft skills makes an information security officer an indispensable resource for any company. Especially in times of growing digital threats, the ISO plays a central role in securing data and IT systems.
What are the advantages of an external information security officer (ISO)?
An external ISO brings experience from many companies and industries, takes an independent view of your security posture and can be adapted flexibly to your needs – without the fixed costs of a full-time position. A professional external ISO helps management to meet legal and regulatory requirements in a verifiable way – responsibility remains with management (Sec. 38 BSIG). We have been taking on the role of information security officer for mid-sized industrial companies for years; our team consists of ISO 27001 Lead Auditors. You can read how this works in practice on our page about the external information security officer (in German).
What does an ISO cost?
An internal ISO ties up a qualified specialist – with salary, training and deputy arrangements. With an external ISO (in German), you pay a fixed monthly fee depending on company size and scope – without hourly billing. If you also need strategic support at management level, you will find our packages on the external CISO page.
About the Author
Can Adigüzel is co-founder and managing director of 360 Digitale Transformation GmbH, a consultant for TISAX® and an ISO 27001 Lead Auditor with more than 200 audits. He has worked in IT project management since 2012 and in information security since 2019. He helps mid-sized companies implement information security pragmatically.