# Security & Compliance [Security & Compliance](https://iits-consulting.de/en/services/cloud-devops/security-compliance) ## Security & Compliance The best audit is the one that doesn’t reveal anything new to you. We prepared the critical infrastructure of one of Europe’s largest port operators for a BSI IT-Grundschutz audit in three months. We implemented controls across multiple data centers, multiple cloud providers, the Kubernetes platform, and the applications running on it. The challenging part of compliance lies beneath your application. We build the controlled foundation, implement the controls on top of it, and keep the evidence up to date—so you can export documentation instead of having to compile it. [Get in touch](https://iits-consulting.de/en/contact/index.md) [Free Cloud Architecture Workshop](https://iits-consulting.de/en/cloud-architecture-workshop/index.md) Our Technology Partners ## TRUSTED BY TEAMS AT: Deutsche Telekom Uniper GOLDBECK PwC Vattenfall Schwarz Gruppe Cornelsen Meridiam ## What exactly is **Cloud Security & Compliance**? BSI IT-Grundschutz, NIS2, DORA, GDPR, or CRA describe what must be met—but the real challenge lies in ensuring that these requirements remain in place even as applications, infrastructure, providers, and requirements are constantly changing. When implemented correctly, compliance goes far beyond merely meeting auditor requirements: It provides you with transparency and control over your assets, data, access, changes, and dependencies—and turns security requirements into something your teams can actually implement in their day-to-day operations. ### Compliance permeates every layer Your application can only be as secure and compliant as the layers beneath it. We build on a robust cloud infrastructure, add platform controls on top of it, and integrate your applications into this foundation. You focus on what’s specific to your application; we take care of the controls beneath it. ### Audits should confirm reality, not create it If proving a control means collecting screenshots, spreadsheets, and tickets from five teams, something is wrong. We keep control statuses, exceptions, and evidence linked to the running platform, so the work is already done when an auditor asks. ### Sovereignty is more than just data storage Knowing where your data is stored is just the beginning. Sovereignty means knowing who controls it, which software and services you depend on, and what a switch would actually cost—including egress costs, platform components that need to be rebuilt, and time. We make portability, transparency regarding dependencies, and exit readiness part of governance—as long as these issues can still be resolved cost-effectively. ## Why This Will Pass the Audit ### Regulated environments are familiar territory Seven years in regulated industries, including critical infrastructure, telecommunications, healthcare, the public sector, and financial services—with experience in audit preparation for one of Europe’s largest port operators. ### We put our recommendations into practice Security, Cloud Architecture, Platform Engineering, and CloudOps work together to ensure that requirements don’t end with an assessment. We translate them into identity controls, policies, guardrails, observability, and operational processes—and can then continue to manage them. ### Compliance starts below the platform T Cloud Public and STACKIT provide us with a robust infrastructure foundation where needed. We build platform controls on top of that so your applications don’t have to reinvent identity, policy, logging, and governance from scratch every time. Open Standards Instead of Hidden Dependencies ### Open Standards Instead of Hidden Dependencies Our platforms rely heavily on widely adopted open-source and cloud-native technologies, including ecosystems managed by organizations such as the CNCF and the Linux Foundation. This gives us greater transparency into the software supply chain and reduces unnecessary dependencies on proprietary services. ### Compliance That Lasts Beyond Go-Live Through KumoOps, our managed CloudOps service, controls, monitoring, and operational baselines remain an integral part of the running platform. [Send Inquiry](https://iits-consulting.de/en/contact/index.md) ## Four Steps. Understand. Build. Validate. ### Determine what applies Your industry, applications, data, providers, and regulatory scope. We map requirements to your actual architecture and identify the relevant gaps. Step 01 ### Implement Identity, encryption, network policies, logging, and guardrails become technical controls within the platform. No more PDFs describing what should happen. STEP 02 ### Maintain Configurations change. Applications change. Regulations change. We continuously track controls, exceptions, and evidence to ensure compliance doesn’t lapse after the project ends. STEP 03 ### Export Evidence See what’s been implemented, close gaps, and provide evidence when auditors or third parties ask—without turning every audit into a new project. STEP 04 CASE STUDY · HEALTHCARE ## A BSI C5 Compliant Cloud for Healthcare Patient Portals Complete redesign and migration of the healthcare infrastructure to the T Cloud Public with BSI C5-compliant security, including client isolation and complex integration of hospital networks. [Read the full case study](https://iits-consulting.de/en/portfolio/a-bsi-c5-compliant-cloud-for-healthcare-patient-portals/index.md) ## Industries we support in ### Critical Infrastructure Security controls, compliance, and sovereignty for environments where availability and resilience are non-negotiable. ### Financial Services Operational resilience, traceability, third-party dependencies, and technical controls related to requirements such as DORA. ### Public Sector Sovereign infrastructure, controlled data access, and verifiable governance in cloud and platform environments. ### Healthcare Protected workloads, strong identity management, and tenant isolation with security and compliance at every level of the infrastructure. iits-consulting’s ability to develop a complex and secure cloud environment under tight deadlines while meeting the highest technical and security requirements has made it a valuable partner. I recommend iits-consulting for challenging IT projects, particularly in areas that require a high level of security and technical excellence. Patrice Brend'amour Vice President of Development CompuGroup Medical SE & Co. KGaA ## What we build with. Our Terraform modules and Helm charts are publicly available. The controls listed below are not a comprehensive list of features—you can review them on GitHub before contacting us. CONTROLS & GUARDRAILS - Kyverno Admission Policies - Keycloak - OIDC & SAML SSO - Cert-Manager - KMS-verschlüsselter Speicher - VPC & Subnetz-Firewalls DOCUMENTATION & QUALITY ASSURANCE - Cloud Trace Service - Policy Reporter - Prometheus - Grafana - Alertmanager - Elastic & Elastic Alert SOVEREIGNTY & SUPPLY CHAIN - Cosign image signin - Registry allowlists - Terraform - Grype - Argo CD - T Cloud Public - STACKIT ## Would your platform pass the audit or just your documentation? Find out what you can demonstrate today, where controls still exist only on paper, and what it will take to close the gap. [Get in touch](https://iits-consulting.de/en/contact/index.md) [See our work](https://iits-consulting.de/en/our-work/index.md)