// ISO 27001 · ISMS · Information security
norm-anker builds information security management systems that fit the organisation — not the other way around. Pragmatic, plain-spoken, no paper mountain and no tool lock-in.
// Three anchors
Policies anyone in the company can read. Reports that fit on a coffee break.
As much structure as needed, as little as possible. An ISMS for 80 people looks different to one for a corporation.
What gets agreed here also holds up under audit pressure — and in the day-to-day after.
// Services
norm-anker focuses on what works day-to-day. No off-the-shelf packages, just a small set of sharply scoped services that complement each other.
From first scoping through certification readiness: we build your information security management system step by step — aligned with ISO/IEC 27001 and shaped around what your business actually needs.
You need accountability, not a full-time hire. I step in as your external Information Security Officer — operationally responsible, with a clear reporting line into management.
Security belongs in the project, not after go-live. For cloud migrations, vendor changes or new platforms, I bring the security perspective in early — before it gets expensive.
Security is behaviour, not paperwork. Tailored formats for leadership, IT teams and staff — clear, useful, and without the wagging finger.
Note: I deliberately do not perform external certification audits myself — independence matters. Instead I work closely with experienced certification bodies and support you all the way up to the audit.
// How we work
A clear approach is half the work. norm-anker follows a model that has proven itself in practice — lean enough for SMEs, thorough enough for certification.
Free, no strings attached. We clarify what you need, possible paths and whether we fit. Around 30 minutes.
Where are you today? We review existing structures, documents and processes — and name gaps, risks and quick wins honestly.
You receive a prioritised plan with realistic effort and timing. No castles in the sky — a list you can actually work through.
We deliver together — with your team, not around it. Responsibilities stay transparent, documents stay readable.
An ISMS is a living thing. On request I stay involved afterwards — as external ISO, in management reviews, or simply as a reliable point of contact.
// Who it fits
The collaboration is a particularly good fit for:
Mid-sized companies with 50–500 employees that need structure without corporate overhead.
Organisations facing compliance demands from customers, regulators or a parent company.
IT departments without a dedicated security role looking for an experienced external lead.
Leadership teams that want to approach ISO 27001 without getting lost in tools and paperwork.
// Lessons
What I have learned in the cockpit, in banking and at the helm of a business — and which of those carry over into an ISMS.
I have held a private pilot's licence since 1993. In aviation nobody accepts "we'll do that from memory". The same applies to an ISMS — and the discipline is good for the day job, too.
If you have built platforms for credit processes and wholesale contracts, you know: short, checkable documents are not red tape, they are how you still know in the morning what you are dealing with.
Software platforms that run for two decades don't collapse on audit day — they collapse in the quiet weeks before and after. That is where an ISMS is decided.
// portrait 
// About
For more than 30 years I have built and operated software platforms for regulated industries — aviation, banking and sustainability among them. As Managing Director and CTO at TEQneers GmbH & Co. KG I led an ISO/IEC 27001 certification project from the inside: audits, day-to-day operation and the ongoing care of the ISMS included. I have also backed that hands-on experience with the formal ISO/IEC 27001 Foundation certification. norm-anker bundles that double perspective — practitioner and accountable lead — into one clear consulting offer.
My standard: security has to fit the organisation, not the other way around. A good ISMS is not the one with the most documents — it is the one still in use long after the auditor has gone home. Alongside the consulting work I have lectured at the Baden-Württemberg Cooperative State University (DHBW) in Stuttgart since 2005 in IT security, web development and databases — experience that also feeds into training and workshops for clients.
// FAQ
// Contact
Tell me briefly where you stand and what is coming up. I usually get back within one business day.