A mountain hut with one lit window under the stars

Security work for regulated organisations in Germany and Switzerland

We help banks, manufacturers, utilities, hospitals and public bodies meet NIS2, DORA and Swiss requirements, secure their plants and clouds, test their defences and prepare their teams for the day an incident happens.

Arrange a first conversation See our services

Two jurisdictions, one standard of work

Security obligations in the German-speaking market have tightened in quick succession. Germany's NIS2 implementation act has been in force since 6 December 2025, without a transition period. DORA has applied to EU financial entities since 17 January 2025. In Switzerland, operators of critical infrastructure have had to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours since 1 April 2025, and FINMA Circular 2023/1 sets out how banks must manage operational risk and resilience.

Alpwacht is a cyber security consultancy with offices in Munich and Zurich. We work for organisations that operate across the border or answer to regulators on both sides of it. Our consultants combine governance, architecture, operational technology and offensive testing, so that a policy written in the boardroom and a firewall rule in a substation describe the same risk.

What we do

Security strategy and governance

Information security management systems, regulatory readiness and board reporting for NIS2, DORA, FINMA and ISO/IEC 27001.

Applicability assessment for NIS2, DORA, FINMA Circular 2023/1 and the Swiss FADP
Gap analysis and remediation roadmap against ISO/IEC 27001:2022
Information security policy framework, roles and risk methodology

OT and ICS security

Security for production lines, substations, water works and building systems, based on the IEC 62443 series.

OT asset inventory and network architecture documentation
Zone and conduit model with target security levels per IEC 62443-3-2
Secure remote access and segmentation design for plants and substations

Security architecture and cloud security

Architecture reviews, identity design and cloud security for public, private and sovereign cloud platforms.

Security architecture review with prioritised findings
Target architecture for identity, privileged access and segmentation
Cloud landing zone security baseline and key management concept

Offensive security

Penetration testing, red teaming and threat-led testing that show how an attacker would reach what matters.

Penetration test report with attack paths, evidence and remediation guidance
Red team scenarios based on threat intelligence for the client's sector
Purple team workshops to turn findings into detection rules

Detection and incident response readiness

SOC design, incident response retainers and exercises, so that the first hours of an incident follow a plan.

SOC target operating model and detection use case catalogue
Incident response plan with reporting workflows for BSI, BACS and FINMA
Incident response retainer with agreed response times and contacts

Third-party and supply-chain security

Security requirements for suppliers, ICT third-party risk under DORA, and product security under the Cyber Resilience Act.

Supplier risk classification and assessment process
Security clauses for ICT contracts and the DORA register of information
Cyber Resilience Act applicability and gap assessment for product lines

When an incident happens

The first month after detection follows deadlines set in law. We prepare teams for each of them before they are needed.

T+0
Detection
An alert is raised and confirmed as a security incident rather than noise.
T+1 h
Containment
Affected systems are isolated, evidence is preserved and the decision-makers are in one room.
T+24 h
Early warning
Under NIS2, essential and important entities send an early warning to the national authority within 24 hours. Swiss critical infrastructure operators report to the BACS within 24 hours.
T+72 h
Incident notification
NIS2 requires a fuller notification within 72 hours, with an initial assessment of severity and impact.
T+1 month
Final report
A final report under NIS2 is due within one month of the notification, with root cause and the measures taken.

Who we work with

Financial services: Banks, insurers, asset managers and payment firms under DORA in the EU and FINMA Circular 2023/1 in Switzerland. We work on ICT risk frameworks, third-party registers, threat-led testing and incident reporting.
Industry and manufacturing: Machine builders, automotive suppliers, chemicals and process industries with production networks that were never designed to be connected. Many now fall under NIS2, and those that sell connected products also face the Cyber Resilience Act.
Energy and utilities: Grid operators, generators, municipal utilities and water suppliers that count as critical infrastructure (KRITIS) in Germany or Switzerland. Our work spans control systems, substations, remote access and the reporting duties that come with operator status.
Healthcare: Hospitals, laboratories and providers of health IT, where availability affects patient care. We support network segmentation of medical devices, incident readiness and the C5 requirements for cloud processing of health data in Germany.
Public sector: Federal, state and cantonal administrations and public enterprises with long-lived systems and procurement rules to respect. We help with security concepts, cloud decisions and the evidence that oversight bodies ask for.

A bare summit above a sea of clouds at sunrise

Security as part of how an organisation is run

Regulation in Europe and Switzerland now treats cyber security as a duty of management, with deadlines and personal accountability. We think that is right. Security decisions belong next to investment, production and compliance decisions, made by people who understand both the business and the technology.

Our aim is to be the firm that engineers and executives both trust to tell them the plain state of things. That means calm assessments, clear priorities and work that still holds up when the auditor, the supervisor or an attacker tests it.

The kind of work we take on

Illustrative engagements, described without client names.

NIS2 readiness for a mid-sized machine builder

A family-owned machine builder in southern Germany has found that it is an important entity under the NIS2 implementation act. It has a capable IT team but no formal security management, and its production halls run on an older network shared with office systems.

We confirm the company's classification, guide its registration with the BSI and run a gap analysis against the act's risk management measures. We then design network segmentation between office and production, set up an incident reporting process, and brief the managing directors on their oversight duties.

Incident readiness for a Swiss utility

A cantonal energy and water utility is subject to the Swiss reporting obligation for cyberattacks on critical infrastructure. Its incident response plan predates the obligation and has never been exercised with management.

We revise the incident response plan to include reporting to BACS within 24 hours, define who decides on shutting down remote access to plants, and run a tabletop exercise built around a ransomware attack spreading from the office network towards control systems.

Threat-led testing for a cross-border bank

A private bank headquartered in Zurich with a subsidiary in Munich must show both FINMA and its EU supervisor that its critical functions withstand realistic attacks.

We build threat scenarios from intelligence on groups known to target private banking, run a controlled red team exercise against agreed critical functions, and close with a purple team phase in which our testers and the bank's defenders replay the attack together.

Work on security that regulators and plant operators depend on

We are hiring security consultants, OT engineers, penetration testers and incident responders for roles in Munich and Zurich, some hybrid. Applications are welcome in English, Hindi, Persian, Turkish and Arabic, and relocation support is available for many positions.

See open roles

A fortnightly brief on cyber regulation and threats in Germany and Switzerland

Every two weeks we summarise new guidance from the BSI, BACS, ENISA, FINMA and the European Commission, along with significant advisories, with links to the original sources and a short note on what each item means for security teams.

Read the brief

NIS2 implementation in Germany and BSI guidance
DORA, FINMA requirements and threat-led testing in financial services
Swiss cyber security law, BACS reporting and the FADP
OT and critical infrastructure security, including the KRITIS umbrella act
Cyber Resilience Act and supply-chain security

Talk to us about your security priorities

Tell us about your organisation, the regulations that apply to you and what you need to achieve, and we will come back to you to arrange a confidential first call. Email contact@alpwacht.com. If you are dealing with an active incident, say so in the subject line.

contact@alpwacht.com