IT governance
The success of a company depends more and more on the effective use of IT applications, which means that IT-related issues must also be included in strategic considerations. The rapid pace of technological development brings many opportunities but also harbors many risks that present companies with new challenges. To ensure sustainable protection in the context of IT-related risks, it is therefore all the more important to align IT strategies and corporate objectives as part of good IT governance.
What is IT governance?
IT governance is a comprehensive approach to managing and controlling IT in companies to promote the achievement of corporate goals. By implementing specific management structures, organizational processes, and internal guidelines, IT governance ensures that the company's IT infrastructure and resources optimally support corporate goals and strategy. It aims to minimize IT-related risks and increase company value through the efficient use of IT. IT governance covers several areas, including the strategic orientation of IT, the allocation of IT-related responsibilities, and the distribution and management of IT resources. Today, IT governance is an integral part of corporate management, ensuring that IT decisions align with overarching corporate goals.
What are the benefits of good IT governance?
Good IT governance offers numerous advantages for companies. By aligning IT with the company's objectives, current and future IT projects can contribute to the company's success. This increases organizational efficiency and agility while reducing costs through the effective use of IT resources. Good IT governance also promotes transparency and communication by clearly defining roles and responsibilities, leading to optimized decision-making. Another significant benefit is the improvement of risk management and compliance, helping companies protect themselves against data breaches and cyberattacks or respond to them effectively. Adequate IT governance can also absolve management of liability in the event of damage, leaving no room for liability on the part of the managing director.
In summary, implementing IT governance processes can increase productivity, reduce costs, and ultimately enhance enterprise value..
What are the requirements of the law?
The NIS 2 Directive requires companies in sectors such as energy, finance and healthcare etc. to protect themselves comprehensively against cyber threats. DORA, the Digital Operational Resilience Act, is aimed specifically at the financial sector and focuses on the establishment of risk management when using information and communication technology ("ICT"). The Cyber Resilience Act (CRA), on the other hand, sets out clear requirements for the cyber security of products with digital elements in order to identify potential security vulnerabilities at an early stage and ensure the integrity of digital systems
Our services in the area of IT governance
- Analysis of the IT governance status
Through an extensive analysis of your existing IT infrastructure regulations, we identify gaps and risks in your processes that make you vulnerable as a company. - Examination of the impact of individual laws
Determining whether a company is subject to individual statutory regulations such as NIS-2, DORA and CRA can sometimes be difficult. We will be happy to carry out an assessment to ensure that your company is on the safe side. - Consulting and implementation
We are happy to support you in complying with the relevant legal requirements and implementing legally compliant IT solutions to improve your IT governance - Definition of processes and creation of guidelines
For large companies in particular, it is important to have individual processes comprehensively defined and written down in guidelines in order to ensure a holistic expansion of IT governance across the entire corporate environment and minimize liability risks - Training in the area of IT governance
As technological change is taking place at all levels of the company, we offer individual training for managers and employees in the area of IT governance, particularly with regard to IT security laws, in order to raise awareness of risks. - Ongoing support
Through ongoing support for your company from our experts, we ensure that you are always up to date with the latest regulatory requirements.
Contact persons
Dirk Koch
Attorney at Law | Partner
CEHv11 – Certified Ethical Hacker | Data Protection Risk Manager | CIPP/E
Olga Stepanova
Attorney at Law | Partner
LL.M. (Berkeley) | CIPP/E | Certified Specialist for Intellectual Property Law | Certified Specialist for IT Law | Data Protection Officer (TÜV)
IT Governance
IT governance refers to the entirety of the structures, processes and responsibilities by which a company manages the use of IT in compliance with the law, securely and in line with its corporate objectives. This includes clear responsibilities for IT security, data protection and compliance, as well as documented decision-making processes. Effective IT governance is a prerequisite for demonstrably meeting regulatory requirements under cybersecurity law, for example those arising from the implementation of NIS-2 or from DORA.
Ultimate responsibility lies with management or the management board, even where operational tasks are delegated to the head of IT, the data protection officer or external service providers. Delegation does not release management from the duty to establish appropriate control and supervision structures. In the event of breaches of duty, personal liability of management may be considered, for example under Section 43 GmbHG (German Limited Liability Companies Act) or Section 93 AktG (German Stock Corporation Act).
ISMS certification, for example under ISO/IEC 27001, is particularly useful where information security is business-critical, customers require corresponding evidence or regulatory requirements apply. It creates clear responsibilities, documented security processes and robust evidence for third parties. Not every company needs certification immediately, however. Often, the initial establishment of an effective information security management system suited to the company’s risk profile and size is more important. Certification also does not replace the data protection assessment under Article 32 GDPR or the specific obligations arising from cybersecurity law.
NIS-2 tightens the requirements for cybersecurity and risk management of companies within its scope. In particular, it requires clear responsibilities, appropriate security measures, effective risk management and the involvement of management. The legal classification is important: NIS-2 is a directive and does not impose direct obligations on companies. The requirements become binding only through the relevant national implementing legislation, in Germany through the NIS-2 Implementation Act (German NIS 2 Implementation Act) with the corresponding amendments to the BSI Act (German Act on the Federal Office for Information Security). Implementation in Germany has been significantly delayed and remained outstanding beyond the European transposition deadline, which is why companies should always determine the specific scope of their obligations by reference to the current state of national legislation. Irrespective of this, it is advisable to assess at an early stage whether the company falls within the scope and whether existing structures, processes and documentation are sufficient or need to be adjusted; in any event, the substantive requirements largely correspond to good IT governance practice.
Under cybersecurity law, in particular under the provisions of the NIS-2 Implementation Act, the management of companies within its scope is required to approve cybersecurity risk management measures and supervise their implementation; breaches may entail personal responsibility for management. Independently of these specific statutory requirements, the general duty of corporate bodies to ensure legality and control risks means that merely delegating responsibility to the IT department is insufficient. Regular training for management itself is also provided for or is urgently recommended.