SEC Consult is now also Qualified Body (QuaSte) for Verification of Compliance with the NIS Act

QuaSte-FAQ's

• What exactly is a Qualified Body (QuaSte)?
  A Qualified Body is a company authorized by the Federal Office for the Protection of the Constitution and Counterterrorism ¹⁾ (BVT) to act as an external auditor of all security measures for the protection of critical infrastructure of operators of essential services.

• Why can’t any service provider take on this task?
  The public must be able to rely on the fact that those critical systems, that are essential for the functioning of services of general interest and economic life, are adequately protected against cyberattacks. Verifying these safeguards is therefore a highly responsible task, the execution of which requires great knowledge, experience and absolute trustworthiness. Proof of being qualified to do so must be provided by companies wishing to become a QuaSte as part of an accreditation process.

• How does the accreditation process work?
  After submitting the application, the company receives a unique identifier that must be used in the future when transmitting the evidence. This uniquely identifies the QuaSte and prevents possible misuse. Then, among other things, the company must prove that its own network and information systems are technically and organizationally secure, indicate which tools it uses, and describe the future verification process in detail and in a meaningful way. Once the evidence has been securely submitted to the BMI, the information is checked and, if successful, the company receives the positive news that it can act as a QuaSte via notification.

• Which requirements must the auditors of a QuaSte fulfill?
  Every auditor must undergo a security check. In this process, his/her trustworthiness is assessed on the basis of personal data that provide information on whether there are any indications that he/she would carry out cyberattacks him/herself. In addition, proof of technical knowledge and relevant professional experience (e.g. through references) as well as any additional training or certifications must be provided.

• What happens when safety deficiencies are discovered?
  In this case, the experts of SEC Consult do what they usually do when they discover vulnerabilities. They propose appropriate measures that are suitable to close the vulnerabilities sustainably. Our employees bring experience from countless security audits and assessments. Equipped with proven analysis tools and always up to date with the latest threats, they are our most important asset to be a reliable partner for our customers.

• Many organizations, without being legally obligated, also want to prove to their customers on their own initiative that they are trustworthy partners when it comes to cybersecurity - and this applies to otganizations of all sizes. What can organizations do who want to voluntarily commit themselves to documenting their diligence and sense of responsibility?
  Of course, we at SEC Consult do not only stand by our customers when acute danger or sanctions are imminent. Our security experts continuously support organizations in their efforts to make their networks and systems more secure. A seal of approval that shows that essential minimum security measures for cyber security have been implemented and that the topic has a corresponding priority in the respective organization can offer a decisive competitive advantage.

¹⁾ Website only available in German. 

How does a review by SEC Consult work?

During the inspection, SEC Consult proceeds in five phases - based on ISO 19011. Everything starts with the initialization of the inspection. Here, the initial contact with the operator is established and the feasibility of the audit is confirmed. For example, we make sure that we receive sufficient information to perform the audit and that the scope is defined.

In the second phase, the inspection is prepared and documented in the inspection plan. An exact test plan is the basis to be able to handle the later steps efficiently and to coordinate with all parties involved on an ongoing basis. Since SEC Consult is also active in the field of standardization, we have first-hand knowledge in defining the corresponding test catalogs.

In the third phase, the SEC Consult auditors check together with the operator's employees whether the technical and organizational security measures are appropriate and effective.

The results are then documented in a test report in the fourth phase. In the audit report, we focus primarily on the comprehensibility of the presentation of the audited areas and the methodology used. With the assessment of the report by a second, non-involved auditor, SEC Consult ensures an objective view on the fulfillment of the requirements. This final report is sent to the audited organization and has to be forwarded to the BMI. In the course of this phase, the presentation of results takes place, in which we present and discuss them with the employees of the operator or derive possible recommendations for action.

The fifth and final phase is post-treatment. In the post-treatment phase, the operator remedies any safety deficiencies. The rectification is subsequently verified and - if satisfactory - confirmed by SEC Consult.