Security Audit Based on ISO/IEC 27001, Annex A

Project overview

The subject of the contract is the execution of a security audit to review the technical and organizational measures (TOMs) of our company, including the data center, based on ISO/IEC 27001, Annex A.

IBI – Institute for Education in Information Society is a non-profit cooperative institute of TU Berlin. Approximately 35 people from various disciplines work together with the goal of strengthening the use of digital media in education and resocialization in the correctional system. We develop and operate tailor-made solutions for specific purposes – based on open-source software. Our IT landscape is operated almost 100% on-premises.

The service includes the following phases, with the percentage indicating the estimated share of the total service:

Phase 1: Document Review (30%)

Phase 2: Onsite Audit (30%)

Phase 3: Final Report (15%)

Phase 4: Training (15%)

Buffer for unforeseen expenses (10%)

• Subject of the Contract
• Scope of Services
• Systematic review of existing documentation against ISO 27001, Annex A
• Creation of a document review report with initial findings
• On-site audit to validate documented measures
• Interviews with management, IT management, and specialist teams
• Sample checks and observation of processes
• Creation of an audit protocol
• Summary of audit results (compliance level per control)
• Gap analysis with risk assessment
• Prioritized action plan with recommendations and implementation deadlines
• Roadmap for the further development of information security
• Recommendations for appointing an internal CISO and optional training
• Training for top management, the internal CISO, and relevant stakeholders on ISO 27001 basics, risk management, and TOM implementation
• Timeline

Project details

8 weeks after order placement

November 2026

Planned end: December 2026

[EUR/hour]

Estimated total price: [EUR] (based on X PT à 8 hours)

Payment terms: 100% upon completion]

References: [2-3 comparable, successfully implemented projects, if available]

All information obtained during the audit must be treated with strict confidentiality (NDA will be provided).

Independence: There must be no conflict of interest with other service providers of the company.

Qualification: Proof of qualification as an ISO 27001 Practitioner Auditor or comparable certification.

Reporting: The deliverables (document review report, audit protocol, final report) must be created in German and in a management-friendly format.

If personal data is processed within the scope of the audit, a Data Processing Agreement (DPA) according to Art. 28 GDPR will be concluded.

Please submit your offer by November 13, 2026, in written form (email is sufficient).

For inquiries, please feel free to contact us:

Contact person: Ivo Schwabe

Email: *@*.tu-berlin.de

Phone: *

We look forward to your feedback and continued successful cooperation.

Job facts: Direct client project

• Remuneration
• Requirements
• Data Protection
• Offer Deadline
• Contact
• Start: 2026-11
• Duration: 1 Monat
• Remote: hybrid
• Location: Berlin, Deutschland, DE
• Languages: German