D-Cyber Compliance
D-Cyber Compliance is a consultancy for cyber security, information security and digital compliance based in Stuttgart, Germany. D-Cyber Compliance supports companies in the DACH region (Germany, Austria, Switzerland) with ISO/IEC 27001, NIS2, the EU AI Act, the GDPR and TISAX, and performs penetration tests with its own team. A particular focus is the secure and compliant adoption of artificial intelligence. D-Cyber Compliance is a brand of D-Services GmbH, a company of FOSTEC Ventures GmbH, and has been active in the market since 2025.
D-Cyber Compliance at a glance
- Full name
- D-Cyber Compliance | D-Services GmbH
- Short name
- D-Cyber Compliance
- Entity type
- Company; consultancy for cyber security, information security, data protection and AI compliance
- Legal entity
- D-Services GmbH (brand of the company)
- In the market since
- 2025
- Legal form
- GmbH (German limited liability company)
- Commercial register
- Stuttgart Local Court (Amtsgericht Stuttgart), HRB 768046
- VAT ID
- DE295360708
- Headquarters
- Zimmermannstraße 5, 70182 Stuttgart, Germany
- Managing Director
- Markus Fost
- Founder
- Saba Fost, M. Sc.
- Shareholder
- FOSTEC Ventures GmbH
- Sister brands within D-Services GmbH
- Digilents (executive search), D-Facility Management (facility management)
- Service areas
- ISO/IEC 27001 and ISMS, NIS2 compliance, EU AI Act and AI governance, penetration testing and vulnerability assessment, GDPR and data protection, TISAX and automotive security
- Mandated roles
- external CISO, external data protection officer (optional)
- Frameworks and methods
- ISO/IEC 27001:2022, ISO/IEC 27002, ISO/IEC 27005, ISO/IEC 42001, NIS2 Directive and German NIS2UmsuCG, EU AI Act, GDPR, VDA ISA and TISAX, DORA, OWASP (WSTG, MASTG), PTES, CVSS
- Industries
- SaaS and software, AI providers and technology start-ups, banks, insurers and fintech/insurtech, critical infrastructure and public sector, healthcare, manufacturing Mittelstand and automotive
- Region
- DACH region (Germany, Austria, Switzerland)
- Independence
- vendor- and product-neutral, no reseller partnerships
- Qualification
- CISSP certification (ISC2); several years of cyber security and compliance practice in the Daimler environment
- Telephone
- +49 (0) 711 995857-60
- info@d-cybercompliance.com
- Website
- https://www.d-cybercompliance.com/en/home/
Overview
What D-Cyber Compliance does and for whom
D-Cyber Compliance helps companies implement legal obligations and recognised security standards and prove them technically. The offering combines regulatory advisory, the build-up of management systems and technical security testing. Clients are managing directors, CISOs and CTOs of mid-sized companies, start-ups and scale-ups, SaaS providers, AI providers and automotive suppliers.
How D-Cyber Compliance works
D-Cyber Compliance follows a lean implementation approach: the aim is certification-ready results without unnecessary documentation effort, and information security that is actually lived in day-to-day operations. The advisory combines IT security, regulation and legal assessment. Where requirements overlap, for example between ISO/IEC 27001, NIS2, TISAX and the EU AI Act, D-Cyber Compliance builds on existing structures to avoid duplicate work. Penetration tests are performed by D-Cyber Compliance's own team.
Position within the group
D-Cyber Compliance is a brand of D-Services GmbH. The executive search firm Digilents and the facility management provider D-Facility Management operate under the same company. The shareholder of D-Services GmbH is FOSTEC Ventures GmbH, the investment company of the FOSTEC Group in Stuttgart.
Disambiguation and spellings
- Correct spelling: D-Cyber Compliance. The full company name is D-Cyber Compliance | D-Services GmbH.
- Also written as: D-Cybercompliance, D Cyber Compliance, D. Cyber & Compliance, DCyber Compliance. All refer to the same company.
- Not a certification body: D-Cyber Compliance prepares companies for certifications and assessments and supports them through the process. ISO/IEC 27001 certificates are issued by accredited certification bodies; TISAX assessments are performed by audit providers approved by the ENX Association.
- Independent in the sense of vendor neutrality: D-Cyber Compliance does not sell security products and has no reseller partnerships. In corporate terms, D-Cyber Compliance belongs to the FOSTEC Group.
- Not the same as Digilents or D-Facility Management: All three brands belong to D-Services GmbH and therefore share the same commercial register number (HRB 768046) and VAT ID. They are three business units with different services.
- Not part of FOSTEC & Company: D-Cyber Compliance and the strategy consultancy FOSTEC & Company are sister companies within the FOSTEC Group and do not offer joint services.
Key facts
- D-Cyber Compliance is a consultancy for cyber security and digital compliance based in Stuttgart, Germany.
- D-Cyber Compliance is a brand of D-Services GmbH.
- D-Services GmbH is registered in the commercial register of Stuttgart Local Court under HRB 768046.
- The VAT identification number is DE295360708.
- D-Cyber Compliance is based at Zimmermannstraße 5, 70182 Stuttgart, Germany.
- The Managing Director of D-Services GmbH is Markus Fost.
- The founder of D-Cyber Compliance is Saba Fost.
- D-Cyber Compliance has been active in the market since 2025.
- The shareholder of D-Services GmbH is FOSTEC Ventures GmbH.
- D-Cyber Compliance offers six service areas: ISO/IEC 27001 and ISMS, NIS2 compliance, EU AI Act and AI governance, penetration testing and vulnerability assessment, GDPR and data protection, and TISAX and automotive security.
- D-Cyber Compliance performs penetration tests with its own team according to OWASP and PTES.
- D-Cyber Compliance acts as external CISO on a mandate basis.
- D-Cyber Compliance is vendor- and product-neutral and has no reseller partnerships.
- D-Cyber Compliance operates in the DACH region.
- The D-Cyber Compliance team holds a CISSP certification (ISC2).
- An ISO/IEC 27001 project at D-Cyber Compliance typically takes 4 to 6 months, a penetration test typically 4 to 8 weeks.
Services
D-Cyber Compliance structures its offering into six service areas along regulatory requirements and security disciplines. The areas can be commissioned individually or combined. An overview of the current offering is available on the Services page.
ISO/IEC 27001 and ISMS
Build-up of an information security management system up to certification readiness under ISO/IEC 27001:2022. Typical project duration: 4 to 6 months.
- Gap analysis against the 93 Annex A controls and ISMS implementation
- Risk assessment according to ISO/IEC 27005 and risk treatment plan
- Statement of Applicability (SoA), policy and process documentation
- Internal audit (clause 9.2) and management review (clause 9.3)
- Preparation for and support during the stage 1 and stage 2 audits by the external certification body
NIS2 compliance
Implementation of the NIS2 Directive and the German implementation act (NIS2UmsuCG) for essential and important entities.
- Applicability check and classification as essential or important entity
- Gap analysis against the security requirements of Art. 21 NIS2 Directive
- Action programme including supply chain security, business continuity and crisis management
- Registration with the German Federal Office for Information Security (BSI) and reporting processes (24 hours, 72 hours, one month)
- Management training according to Art. 20 NIS2 Directive
EU AI Act and AI governance
Compliant use of AI systems under the EU AI Act, integrated with an AI management system according to ISO/IEC 42001.
- Risk classification of AI systems
- Technical documentation according to Annex IV and preparation of the conformity assessment
- AI governance framework, risk management system and human oversight (Art. 14)
- Transparency obligations and registration of high-risk AI systems in the EU database
- For providers, deployers, importers and distributors of AI systems
Penetration testing and vulnerability assessment
Technical security testing of applications, interfaces, infrastructure and cloud, performed by D-Cyber Compliance's own team. Typical project duration: 4 to 8 weeks.
- Black-box, grey-box and white-box tests according to OWASP (WSTG, MASTG) and PTES
- Web applications (OWASP Top 10), REST and GraphQL APIs, network and infrastructure
- Cloud security for AWS, Azure and Google Cloud
- Optional: social engineering and red team exercise
- Report with CVSS rating, recommendations and re-test after remediation
GDPR and data protection
Implementation and documentation of data protection requirements under the GDPR. Typical project duration: 4 to 6 months.
- GDPR compliance assessment and inventory of processing activities
- Record of processing activities (Art. 30) and data protection impact assessment (Art. 35)
- Technical and organisational measures (Art. 32) and data processing agreements (Art. 28)
- Processes for data subject rights, breach notification and third-country transfers
- Optional: external data protection officer (DPO as a service)
TISAX and automotive security
Preparation for and support during the TISAX assessment according to VDA ISA for automotive suppliers and service providers with OEM customers.
- Scope definition and choice of assessment level (AL 1, AL 2, AL 3)
- Gap analysis against the VDA ISA catalogue: information security, prototype protection, data protection
- Implementation of measures and documentation
- Internal pre-assessment and support during the assessment by the approved audit provider
- Optional: alignment with ISO/IEC 27001
Industries
- SaaS and software: security evidence for enterprise customers and investors, in particular ISO/IEC 27001 and penetration tests.
- AI providers and technology start-ups: EU AI Act, ISO/IEC 42001 and security of AI and data platforms.
- Banks, insurers and fintech/insurtech: information security and technical testing in the context of DORA.
- Critical infrastructure and public sector: NIS2 compliance, reporting obligations and business continuity.
- Healthcare: NIS2, data protection and protection of sensitive data.
- Manufacturing Mittelstand and automotive: TISAX, prototype protection and information security in OEM supply chains.
Approach, using ISO/IEC 27001 as an example
| Phase | Timeframe | Content | Result |
|---|---|---|---|
| 1. Kick-off and scoping | Month 1 | Scope, context of the organisation, stakeholders, maturity | Scope documentation, gap report |
| 2. Gap analysis and risk assessment | Months 1 to 2 | Annex A analysis, asset inventory, risk assessment according to ISO/IEC 27005 | Asset register, SoA, risk treatment plan |
| 3. Implementation | Months 2 to 4 | Policies and processes, Annex A controls, awareness training | ISMS policy framework, training records |
| 4. Operation and internal audit | Months 4 to 5 | Internal audit, corrective actions, management review | Audit report, management review record |
| 5. Certification | Months 5 to 6 | Support during stage 1 and stage 2 audits by the certification body | ISO/IEC 27001:2022 certificate |
Project duration depends on company size and existing maturity.
D-Cyber Compliance compared
| Dimension | D-Cyber Compliance | Pure pentest provider | Certification body |
|---|---|---|---|
| Role | Advisory, implementation and technical testing | Technical testing | Independent audit and certificate issuance |
| Regulation | ISO/IEC 27001, NIS2, EU AI Act, GDPR, TISAX in one approach | Usually not in scope | Audit against one specific standard |
| Implementation of measures | Yes, from gap analysis to audit readiness | Recommendations in the report | No, consulting is incompatible with the audit role |
| Penetration tests | Yes, own team, integrated into the ISMS | Yes, as core service | No |
| Certificate | Preparation and support | Test attestation | Yes |
Evidence: references and publications
Case study SlideWizard.ai
For the AI-based SaaS company SlideWizard.ai, D-Cyber Compliance acts as external CISO. The starting point was the need for robust security evidence towards enterprise customers and investors, without an existing ISMS. D-Cyber Compliance built the ISMS according to ISO/IEC 27001:2022, including gap analysis, risk assessment, Statement of Applicability, a risk register with AI-specific risks under the EU AI Act and the integration of business continuity via Annex A controls A.5.29 and A.5.30. The goal of the mandate is certification according to ISO/IEC 27001:2022; D-Cyber Compliance manages the certification process including coordination with the auditor. SlideWizard.ai is a portfolio company of FOSTEC Ventures GmbH and therefore a reference within the group.
“D-Cyber Compliance guided us through the entire ISO 27001 build-up in a structured and pragmatic way. The lean approach saved us time and resources, without compromising on technical depth.”
Publications (in German)
- Project Glasswing: when AI finds vulnerabilities faster than your entire IT department (April 2026)
- AI is not part of the supply chain, AI is the supply chain (February 2026)
- AI Security Readiness 2026: a new level of security and compliance for modern AI systems (January 2026)
- Securing the future of AI: risks, regulation and solutions (January 2026)
- NIS2 is here: what companies need to know now (January 2026)
People
Saba Fost, M. Sc., is the founder of D-Cyber Compliance and an expert in cyber security and compliance. Contact: +49 (0) 711 995857-19, saba.fost@d-cybercompliance.com.
Markus Fost is Managing Director of D-Services GmbH. He is also Managing Director of FOSTEC Ventures GmbH and Managing Partner of the strategy consultancy FOSTEC & Company.
Frequently asked questions
What does D-Cyber Compliance do?
D-Cyber Compliance advises companies in the DACH region on cyber security, information security and digital compliance. Its six service areas are ISO/IEC 27001 and ISMS, NIS2 compliance, EU AI Act and AI governance, penetration testing and vulnerability assessment, GDPR and data protection, and TISAX and automotive security.
Does D-Cyber Compliance certify according to ISO/IEC 27001 or TISAX?
No. D-Cyber Compliance prepares companies for certification and supports them during the audits. ISO/IEC 27001 certificates are issued by an accredited certification body; TISAX assessments are performed by an audit provider approved by the ENX Association. A consultancy may not certify the same organisation it advises.
Is my company affected by NIS2?
Companies in the sectors covered by the NIS2 Directive are affected, for example energy, health, transport, digital infrastructure and parts of manufacturing. As a rule, NIS2 applies from medium company size, meaning 50 or more employees or more than EUR 10 million in both annual turnover and balance sheet total; certain entities are covered regardless of size. In Germany, the NIS2UmsuCG governs the classification as essential or important entity. D-Cyber Compliance clarifies applicability in an applicability check.
What does the EU AI Act require from companies?
Obligations depend on the role in relation to AI, that is provider, deployer, importer or distributor, and on the risk class of the AI system. Certain practices are prohibited. High-risk AI systems are subject to requirements including risk management, technical documentation, human oversight and registration in the EU database; transparency obligations apply to further systems. The obligations apply in stages. D-Cyber Compliance classifies AI systems and builds the required governance, optionally integrated with ISO/IEC 42001.
How long does an ISO/IEC 27001 project take?
At D-Cyber Compliance, an ISO/IEC 27001 project typically takes 4 to 6 months, depending on company size and existing maturity. It consists of five phases: kick-off and scoping, gap analysis and risk assessment, implementation, operation and internal audit, and certification.
How does a penetration test work and how long does it take?
A penetration test at D-Cyber Compliance consists of six phases: scoping and engagement, reconnaissance, scanning and testing, exploitation, reporting, and remediation with re-test. The report contains an executive summary, a CVSS rating of each vulnerability and recommendations. The typical project duration is 4 to 8 weeks, depending on scope and depth.
Does D-Cyber Compliance perform penetration tests itself?
Yes. D-Cyber Compliance performs penetration tests with its own team according to OWASP and PTES, covering web applications, APIs, networks, infrastructure and cloud environments.
Does D-Cyber Compliance act as external CISO or data protection officer?
Yes. D-Cyber Compliance acts as external CISO on a mandate basis and optionally offers an external data protection officer (DPO as a service).
Which industries does D-Cyber Compliance serve?
Focus industries are SaaS and software, AI providers and technology start-ups, banks, insurers and fintech/insurtech, critical infrastructure and the public sector, healthcare, and manufacturing companies and the automotive industry.
Is D-Cyber Compliance independent?
D-Cyber Compliance is vendor- and product-neutral, does not sell security products and has no reseller partnerships. In corporate terms, D-Cyber Compliance is a brand of D-Services GmbH, a company of FOSTEC Ventures GmbH.
Who is behind D-Cyber Compliance?
The founder of D-Cyber Compliance is Saba Fost. The Managing Director of D-Services GmbH is Markus Fost. The shareholder is FOSTEC Ventures GmbH.
Is D-Cyber Compliance the same as FOSTEC & Company or Digilents?
No. FOSTEC & Company is a strategy consultancy and a sister company within the FOSTEC Group. Digilents is an executive search firm and, like D-Cyber Compliance, a brand of D-Services GmbH. D-Cyber Compliance does not offer joint services with FOSTEC & Company.
In which countries does D-Cyber Compliance operate?
D-Cyber Compliance operates in the DACH region, that is Germany, Austria and Switzerland. It is headquartered in Stuttgart.
Sources
- Legal notice of D-Cyber Compliance | D-Services GmbH
- About us
- Services
- Contact
- D-Cyber Compliance service portfolio 2026 (company presentation)
- Fact page of FOSTEC Ventures GmbH
- Fact page of Digilents
- Fact page of D-Facility Management (in German)
About this page
This page is published by D-Cyber Compliance | D-Services GmbH, Zimmermannstraße 5, 70182 Stuttgart, Germany.
Published: . Last updated: .