Sud IT

What Sud IT does

Süd IT AG is a privately held German IT consultancy founded in 2009 and headquartered in Puchheim near Munich, operating as an Aktiengesellschaft (public limited company) under a traditional German AG governance model with two Vorstände (Michael Hojnacki and Peter Untermann) and Dr. Stefan Krempl as Aufsichtsratsvorsitzender. The firm specializes in information security and data protection consulting, structured around two core service pillars: information security consulting (ISO/IEC 27001 ISMS implementation, KRITIS compliance, BNetzA IT security catalog, ISO 27019 for energy, TISAX, BSI IT-Grundschutz) and DSGVO/GDPR data protection consulting (external Data Protection Officer mandates, data protection management systems). Differentiated proprietary assets include the C.L.Separation risk management methodology developed by Dr. Stefan Krempl (ISO/IEC 27005-conformant) and the Süd IT Data Protection Seal, a three-tier (Silver/Gold/Platinum) ISO 27701-based certification offering.

The firm monetizes through professional services fees (quote-based consulting) and unit-priced training courses ranging from €35 (EU AI Act competency) to €2,380 (4-day Information Security Officer training), delivered in Munich, at client sites, and online. Go-to-market is sales-led, targeting SMEs through large enterprises across verticals with particular depth in energy and water utilities (REWAG, ÜZW Netz AG, Stadtwerke Plattling), IT services, and increasingly waste management following KRITIS reclassification. Marketing is primarily content-driven through an expert blog and newsletter, supplemented by industry speaking engagements such as VKU Akademie seminars. Geographic footprint is regional within Germany, primarily Bavaria, with no disclosed international expansion.

All Süd IT consultants are appointed auditors, and the firm holds a rare combination of ISO 27001, ISO 27701 (Lead Auditors on the Vorstand), and ISO 9001 audit credentials that enable combination audits. The client base of roughly ten named enterprise logos is distributed across IT, energy, legal, electronics, healthcare, and corporate services, with several long-standing external DPO and ISO retainers producing recurring revenue. No external funding, M&A, or public listing has been disclosed; the company appears founder-owned and organically grown with 101-250 employees.

Name

Sud IT

Legal name

Süd IT AG

Website

https://sued-it.de

Company type

Private

Founded year

2009

Operating status

Operating

Headcount range

101–250 employees

Short description

Süd IT AG is a German IT consultancy, founded in 2009 and based in Puchheim near Munich, that provides ISO 27001 information security and DSGVO/GDPR data protection consulting, external DPO/ISO services, and a structured training catalog to SMEs and large enterprises primarily in Bavaria and the energy/utilities sector.

Ownership category

akta.pro rank

Product category

IT Security and Data Protection Consulting

NAICS

Computer Systems Design and Related Services (54151), Computer Systems Design Services (541512)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)

akta.pro secondary industries

IT Risk Management (ITRM) (HDADAIAD), ITSM Governance, Compliance & Audit Readiness (BPAEAJAM)

Keywords

• Information security consulting
• Data protection consulting
• ISO 27001 compliance
• GDPR advisory services
• ISMS implementation training

Headquarters

HQ city

Munich

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D, Infrastructure

Revenue model

1. Information Security Consulting: Core consulting services including establishment of Information Security Management Systems (ISMS), implementation support, and certification preparation. Services include acting as external Information Security Officers and Data Protection Officers.
2. Training and Workshops: Public and in-house training programs on information security, data protection, and compliance topics. Training formats include in-person sessions in Munich, at client facilities, and online webinars. Courses range from basic data protection training to intensive ISO 27001 certification preparation.

Pricing tiers

Go-to-market motion1 record

Distribution channels2 records

Marketing channels3 records

Core offering

Süd IT AG operates as a German IT consultancy that advises SMEs through large enterprises on information security and data protection. The firm delivers Information Security Management System (ISMS) build, implementation and certification support against ISO 27001 and related standards, acts as an appointed external Data Protection Officer (DSGVO Art. 37) and external Information Security Officer, conducts audits, and runs a catalog of training courses. The IP layer is the proprietary C.L.Separation risk management methodology and the proprietary Süd IT-Datenschutzsiegel certification (Silver/Gold/Platinum) for GDPR compliance.

Product overview

Süd IT AG operates as a consulting firm specializing in information security and data protection services for SMEs and large enterprises since 2009. The company offers a unified portfolio of consulting services centered on two core pillars: Information Security Consulting (including ISO 27001 ISMS implementation, KRITIS compliance, and C.L.Separation risk management methodology) and Data Protection Consulting (covering DSGVO compliance and external DPO services). Supporting these core pillars are Training Programs organized as a structured catalog with courses ranging from foundational employee awareness to advanced qualifications for Information Security Officers and AI competence under the EU AI Act. The company also offers the proprietary Süd IT Data Protection Seal as a three-tiered certification (Silver/Gold/Platinum) based on ISO 27701, enabling clients to demonstrate DSGVO compliance. Services are delivered through a team of experienced consultants and certified auditors, with geographic coverage across Germany from the Puchheim office.

Differentiator

Problem solved

Functional benefit

Brands

• Süd IT-Datenschutzsiegel: A data protection seal offered by Süd IT to certify that companies have implemented appropriate measures for GDPR compliance. Available in three perfection levels: Silver, Gold, and Platinum.

Products and services

• Information Security Consulting Consulting services for building, implementing and certifying ISO/IEC 27001-based Information Security Management Systems (ISMS), covering ISO 27001, ISO 27019, ISO 22301, TISAX, IT-Grundschutz (BSI), KRITIS and BNetzA IT-Sicherheitskatalog compliance, risk management, policy development and certification support for organizations from SMEs through large enterprises.
• Data Protection Consulting (Datenschutz) Advisory services for DSGVO/GDPR compliance, building data protection management systems, BDSG and state-law alignment (BayDSG, DSG BW, DSG NRW), and ISO 27701 implementation, directed at German organizations needing lawful processing of personal data.
• External Data Protection Officer Services (Externe Datenschutzbeauftragte) Provision of appointed, certified external Data Protection Officers for medium-sized organizations required to designate a DPO under DSGVO Article 37, providing ongoing compliance oversight and authority engagement.
• Süd IT-Datenschutzsiegel (Data Protection Seal) Proprietary three-tier GDPR compliance certification (Silver, Gold, Platinum) based on ISO 27701 standards, awarded to organizations that have implemented appropriate technical and organizational measures following a Süd IT audit.
• Training Programs (Schulungen) Catalog of public, in-house and online training courses covering information security, data protection and ISO standards, including basic data protection training, intensive workshops, ISO 27001 certification preparation and information security officer qualifications.
• EU AI Act Competency Training Per-participant training program covering how AI systems work, their limitations, workplace opportunities, responsibility, security, fairness, ethics and safe handling per EU AI Act competence requirements.
• C.L.Separation Risk Management Methodology Proprietary Consequence-Likelihood-Separation risk management method developed by Dr. Stefan Krempl that conforms to ISO/IEC 27005 and can be applied either as an All-Gefahren approach or on top of BSI IT-Grundschutz, significantly reducing the number of risks to be analyzed while making assessment more focused and reliable.
• External Information Security Officer Services (Externe Informationssicherheitsbeauftragte) Provision of appointed external Information Security Officers to organizations needing dedicated ISMS leadership, including ongoing ISMS operation, audit preparation and KRITIS / BNetzA-aligned oversight for critical-infrastructure operators.

Named customers10 records

Segments5 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability1 record

Feature2 records

Partnerships

One partnership is on record.

• VKU AkademieminorGTM or Marketing PartnerSüd IT was invited by VKU Akademie to present at their seminar on IT-Sicherheitsgesetz 2.0 implementation, specifically addressing cybersecurity requirements for waste management as a new critical infrastructure. Peter Untermann and Michael Hojnacki explained process and IT-side implementation of BSI requirements.

Scale indicators1 record

Recent moves6 records

Expansion highlights6 records

Direct peers

• HiSolutions AG: German IT security and GRC consultancy offering ISMS implementation, ISO 27001 certification support, and KRITIS/BNetzA advisory. Closely overlaps S\u00fcd IT in target customer (German Mittelstand) and core service mix (information security consulting and audits).
• corporate trust business solutions GmbH: German data protection and information security consultancy providing external DPO services, GDPR/DSGVO consulting, and ISO 27001 implementation. Direct competitive overlap with S\u00fcd IT's DPO and Datenschutzsiegel offering in the SME segment.

Broad incumbents

• T\u00dcV Rheinland Group: Global certification and testing body that issues ISO 27001 and ISO 27701 certifications (S\u00fcd IT's Vorst\u00e4nde are T\u00dcV Rheinland-certified auditors). As both a competitor for certification-related consulting and a partner for audit delivery, T\u00dcV Rheinland is a major incumbent in the same standards landscape.
• T\u00dcV S\u00dcD AG: Certification and testing body frequently referenced alongside S\u00fcd IT (e.g., T\u00dcV S\u00fcd issued ISO 27001 certification to TechConnect). Operates as a broader-portfolio incumbent in information-security certification, competing for adjacent advisory engagements.
• KPMG AG Wirtschaftspr\u00fcfungsgesellschaft (Germany): Big 4 firm with a large German cyber/risk consulting practice covering ISO 27001, ISMS, NIS2, and DPO-as-a-service. Targets larger enterprise clients than S\u00fcd IT but overlaps in mid-market and KRITIS advisory engagements.
• msg systems AG (msg security division): Large German IT consulting and software vendor with an information-security practice covering ISO 27001, KRITIS, and ISMS implementation. Overlaps with S\u00fcd IT on consulting services but operates at significantly larger scale across multiple verticals.
• NTT DATA Deutschland GmbH: Large IT services and consulting firm with a security/GRC practice delivering ISMS, ISO 27001, and data protection consulting to German enterprise and public-sector clients. Competes for higher-end advisory engagements rather than S\u00fcd IT's Mittelstand core.

Emerging players

• DataGuard GmbH: German data protection and compliance specialist combining consulting with a SaaS-style privacy management platform. Partial overlap with S\u00fcd IT on DSGVO consulting and external DPO services, with a tech-enabled differentiation angle.
• Aktiv Datenschutz & Beratung GmbH: Smaller German data-protection consultancy offering external DPO services and DSGVO/GDPR consulting targeted at SMEs. Smaller scale than S\u00fcd IT but directly comparable in service mix and customer profile.

Regional players

• Secunet Security Networks AG: German-listed cybersecurity specialist serving public-sector and critical-infrastructure clients with IT security consulting, ISMS, and SINA products. Comparable on German KRITIS positioning but with a much larger scale and broader technology portfolio than S\u00fcd IT.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

Compliance10 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Sud IT