Consulting & Support
Consulting & Support
For financial institutions and IT service providers: understand requirements, identify risks and agree concrete next steps – through workshops, checks and support into implementation.
Offers at a glance
Workshops and base checks at a fixed price for the stated scope. Consulting, technical security reviews and ongoing support are separately scoped engagements with a price on request.
Build knowledge or review a specific area: workshops, audit preparation and technical security checks offer a focused starting point.
Two levels. The right starting point.
Build a clear understanding of DORA or deepen your existing knowledge: choose the one-day workshop that matches your team's experience.
For IT and process owners, information security, ICT risk management and compliance teams.
Per option: 1 day · 09:00–17:00 including breaks · up to 10 participants
No prior knowledge required
The right fit if … you want to build a shared knowledge base and understand DORA in your day-to-day work.
A shared understanding, an initial overview of roles and concrete next steps for your team.
For teams with DORA knowledge
The right fit if … you already know DORA and want to turn requirements into workable processes and well-founded decisions.
Documented solution outlines, reasoned decisions and prioritised implementation steps from the exercises.
Each option can be booked independently. Advanced Application builds on foundational knowledge, not on mandatory attendance at the first workshop. We agree the right starting point with you in advance.
Each workshop covers two practical cases, with outcomes and next steps documented by the end of the day. Advanced Application is a working and learning format: it does not include production implementation, an audit or a comprehensive compliance assessment.
Specialised for IT service providers
For account and service management: understand DORA requirements and confidently engage in regulatory discussions with clients.
A targeted training format with additional preparation and practical application. Unlike the general DORA Practical Workshop, it is specifically designed for your client-facing teams.
2 service days · all phases on site
One-day workshop
Review selected evidence together and practise an audit interview. Your team learns how to connect requirements with supporting evidence.
1 day · 09:00–17:00
Up to 10 participants
For process and control owners and teams preparing for audit interviews.
One process, one agreed set of assessment criteria and up to 3 controls. Joint review of no more than 3 documents totalling 20 pages. 09:00–17:00, including breaks. The focus is enabling your team, not independently auditing the whole organisation.
Document & evidence review
I review the existing documents and evidence myself, recording what is supported and where evidence is still missing.
2 consecutive days
2 interviews · 30 minutes each
For owners seeking a targeted review of documentation and evidence before an audit.
One company, one review area and one agreed set of assessment criteria. Up to 5 requirements or controls; no more than 5 documents totalling 50 pages, including annexes and evidence. Day 1: review and two 30-minute interviews. Day 2: assessment, report and handover. Missing information is marked as not assessable. No implementation or comprehensive audit or certification commitment.
Separate offer · Price on request
Available as a separate engagement, not included in the base check’s fixed price. Scope, schedule and pricing are agreed individually.
Beyond a single review area, an organisation-wide check of your audit or DORA readiness is available. We consider the agreed review areas, requirements and evidence, and how the teams involved work together. The result is a clear picture of the assessed scope, open evidence questions and prioritised next steps for your preparation.
Price available only on request. Not included in the listed fixed price. Scope, review depth, deliverables and schedule are agreed individually in advance, based on organisation size, complexity and available documentation. The stated service days and quantity limits apply to the base package.
Request a tailored proposalIncidents & reporting
Use an agreed scenario to review how detection, decision-making and reporting work together in your process.
2.5 consecutive days
Up to 8 participants on the joint working day
One process, one scenario and no more than 5 documents totalling 50 pages. 1 day of discovery, 1 day of practical work and 0.5 day to wrap up. A planned process review, not an emergency incident-response service.
Separate offer · Price on request
Available as a separate engagement, not included in the base check’s fixed price. Scope, schedule and pricing are agreed individually.
The check can be extended to the agreed incident and reporting processes across your organisation. We focus on detection, assessment, decisions, escalation and reporting, including handovers between teams and service providers. Using agreed scenarios, we review how these elements work together. This remains a planned process review, not an emergency incident-response service.
Price available only on request. Not included in the listed fixed price. Scope, review depth, deliverables and schedule are agreed individually in advance, based on organisation size, complexity and available documentation. The stated service days and quantity limits apply to the base package.
Request a tailored proposalGovernance & accountability
Make responsibilities, handovers and decisions in a specific process transparent and identify improvements.
2.5 consecutive days
Up to 6 participants on the joint working day
One process, no more than 10 documents totalling 100 pages and two interviews. We agree the document selection in advance. 1 day of discovery, 1 day of practical work and 0.5 day to wrap up. The focus is the agreed process, not a comprehensive governance audit.
Separate offer · Price on request
Available as a separate engagement, not included in the base check’s fixed price. Scope, schedule and pricing are agreed individually.
Beyond a single process, we examine organisation-wide governance within an agreed thematic scope, including DORA where relevant. This covers responsibilities, decision-making bodies, escalation paths, cross-functional handovers and supporting documentation. The aim is clear findings and concrete next steps for developing your governance.
Price available only on request. Not included in the listed fixed price. Scope, review depth, deliverables and schedule are agreed individually in advance, based on organisation size, complexity and available documentation. The stated service days and quantity limits apply to the base package.
Request a tailored proposalTargeted reviews of access and logging. Identify security gaps and prioritise improvements – within a clearly agreed scope.
Identities, permissions & privileged access
Who can access a critical service, through which accounts and approvals? I examine human, machine and privileged identities across an agreed application or access chain.
For IT, information security, IAM/PAM and application operations owners in financial organisations and IT service providers.
Architecture and role documentation, existing access management processes and named contacts. Provide only agreed, necessary extracts; do not send passwords, keys or other credentials.
One critical application or clearly bounded access chain. Systems, account types, samples and assessment criteria are agreed in advance. The review uses documentation, approved evidence and joint walkthroughs; missing evidence is explicitly identified.
No complete access recertification, penetration testing, certification or security guarantee. No changes to production systems. Product deployment, further technical testing and implementation require a separate engagement.
Logging, SIEM integration & evidence
An event occurs - can you establish who did what and when? For an agreed service, I review which events are recorded, how they are brought together and who analyses them.
For IT, information security, platform operations and SIEM owners, and teams with technical traceability requirements.
Service and logging architecture, a list of log sources, existing analysis use cases and named owners. Provide approved log examples in anonymised or pseudonymised form where possible; exclude sensitive content and credentials.
One service and an agreed selection of relevant events. Log sources, samples and business evidence requirements are defined in advance. Existing traceability is assessed using approved documentation and examples; complete coverage of all events is not promised.
No SOC or 24/7 operation, guaranteed attack detection or forensic investigation. No production changes or automatic legal assessment of retention periods. Technical implementation and further effectiveness testing are agreed separately.
For a specific architecture decision or an upcoming audit - supporting an IT service provider or the organisation being audited. Scope, dates and price are agreed individually.
Enterprise & Security Architecture
You need to decide on a cloud, platform or integration approach. We compare the relevant options against your business objectives, security requirements and operational constraints.
For IT leaders, architecture owners and project teams in financial organisations and IT service providers.
A specific decision to be made, existing architecture and integration documentation, and contacts from the business, IT, security and operations. Required materials and interviews are agreed in advance.
One bounded decision for a solution, platform or integration. The proposal defines the options, interviews and systems to be considered. IAM/PAM or logging can be agreed as a specialist focus.
No complete enterprise architecture, product deployment or technical implementation. Your organisation retains responsibility for the decision and approval.
Preparation & subject-matter support
A financial-sector client announces an audit. I help you bring together evidence and responsibilities, prepare subject-matter owners and address open questions in a traceable way.
For IT service providers serving banks, insurers or other financial organisations, particularly service management, information security and audit coordination teams.
Audit notice, questionnaire or requirement list, existing evidence and named owners. Confidentiality and permitted sharing of client materials are clarified in advance.
One defined client audit at an IT service provider. Review areas, evidence volume, meetings and follow-up are bounded individually. Unlike a training course, this engagement supports a real audit process.
No independent audit or certification, legal opinion or assurance of a particular audit outcome. Implementing all findings is not included in the audit support.
DORA · BaFin · SWIFT · SEPA
Your organisation is being audited. I help prepare your teams, bring together evidence and responsibilities, and support auditor requests and discussions through to structured follow-up.
For banks, insurers, payment service providers and other organisations facing relevant IT, security or governance audits and reviews.
The audit notice, requirement list, existing evidence and named owners. Approvals, confidentiality and permitted document sharing are clarified in advance.
One defined audit or review, supporting your organisation as the auditee, for example relating to DORA, BaFin, SWIFT CSP/CSCF or SEPA. The review basis, topics, evidence, meetings and follow-up are agreed individually.
Unlike client audit support for IT service providers, this engagement supports the organisation undergoing its own audit or review. Other review contexts can be agreed after scoping.
No independent audit, certification, legal advice or assurance of an audit outcome. No assumption of the assessor role, including an independent SWIFT CSP assessment. Implementation of actions requires a separate engagement.
Turn selected findings into deliverables, or secure regular architecture support with agreed capacity. Both are separately commissioned engagements with a price on request.
Part-time advisory engagement
You need experienced architecture support without a full-time appointment. Within an agreed part-time mandate, I support decisions, reviews and alignment between business, IT and security teams.
For IT leaders and change programmes with recurring architecture needs and clearly identified internal decision owners.
An internal sponsor, named decision owners, access to relevant architecture documentation and an agreed schedule of meetings.
A part-time advisory mandate with agreed monthly capacity. Onboarding, preparation, discussions and documentation are included in that capacity. Additional requirements are agreed in advance.
No daily availability, on-call service or automatic assumption of people management or overall operational responsibility. Decisions and approvals follow the expressly agreed mandate.
Beyond the listed formats
These offers are starting points, not a closed catalogue. I also support individual questions and cross-cutting projects in these areas:
We agree the scope, approach, timing and fee to match your project.
Open enquiryDelivered personally on siteGermany · Austria · Switzerland · Netherlands
Fixed-price base formatsReturn travel and necessary accommodation included
Scope can be extendedBase formats: up to 2.5 days · organisation-wide by agreement
This process describes our workshops and base checks. For consulting and ongoing support, we agree on the approach, on-site and remote work individually.
We clarify the objective, review area and available documents.
We agree on the offer, location and schedule.
We address your topic within the agreed scope.
You receive the agreed outputs and next actions.
Your consultant
I connect enterprise architecture, security and regulatory governance. My experience includes supporting BaFin-, SWIFT- and SEPA-related reviews, data-centre assessments and TSI and ISO/IEC 27001 certification processes.
In banking, I have held responsibility for DORA readiness and audit-ready documentation. This includes translating regulatory requirements into architecture and operating processes, developing governance, and assessing IT and integration architectures from a security and compliance perspective. I connect the regulatory perspective with technical implementation.
I led a major client audit on the service-provider side for a strategically important client. I therefore also know the audit situation from the perspective of the organisation being assessed. This complements my experience supporting reviews in banking and data-centre environments.
I have provided specialist support to an internal corporate governance team, assessed security and regulatory topics, and trained account managers on DORA. The focus was on explaining requirements clearly and preparing teams for regulatory discussions with clients, connecting governance, technology and client-facing work.
I bring this experience to my workshops and checks: we consider not only individual documents, but also how requirements, responsibilities and technical practice fit together. Within the agreed scope, we assess existing evidence, identify open questions and define concrete next steps.
Consulting and preparation – no independent assurance opinion, certification or guarantee of a particular audit outcome.
Let’s talk
Let me know which offer interests you, your location and a preferred date. Together, we can clarify whether the format fits your needs.
info@bergermann-consulting.de+49 176 22636371
All prices are net. Fixed-price base formats include return travel and necessary accommodation within Germany, Austria, Switzerland and the Netherlands. Organisation-wide checks are quoted individually. Travel and accommodation for individually scoped engagements are defined in the proposal.
You can contact me directly by email: info@bergermann-consulting.de. The enquiry assistant requires JavaScript.