EDV-Unternehmensberatung Floß GmbH

What EDV-Unternehmensberatung Floß GmbH does

EDV-Unternehmensberatung Floß GmbH is a privately held German consulting firm founded in 1996 and headquartered in Versmold, North Rhine-Westphalia. The firm specializes in integrated data protection and information security advisory, combining technical IT security expertise with certified legal data protection qualifications under German law (BDSG) and the EU GDPR (DSGVO). Service lines include external Data Protection Officer retainers (Pauschal­honorar model), GDPR data protection consulting and audits, IT forensics, ISO 27001 and TISAX® certification support, NIS-2 compliance advisory (delivered in partnership with pitc-legal / Eckhardt Rechtsanwälte), penetration testing, security assessments, phishing simulations, Microsoft 365 compliance, and IT expert witness services. The firm also operates CADAIS Deutschland, a proprietary online training campus for data protection and information security, and runs the Digital Safety Day school education initiative founded by the firm's principal in 2007.

The company serves a diversified client base across German SMEs, mid-market firms, and large enterprises, spanning automotive (Porsche, HBPO, Valmet), insurance (ERGO Direkt, R+V), logistics (Hermes Germany), energy (RWE IT), media (Bertelsmann mediaSystems), healthcare (IONCOR, nursing facilities), trades, schools, associations, and public institutions including courts and public prosecutor's offices. Vertical specialization is a deliberate go-to-market dimension, with dedicated practice pages for crafts (Handwerk), nursing (Pflege), KMU, associations (Vereine), schools/kindergartens, corporates (Konzerne), pharmacies, and therapy practices. The team is approximately 9–15 people, led by founder-managing director Thomas Floß and co-managing director/shareholder Sebastian von der Au.

The business model is a hybrid of professional services fees and recurring subscription retainers. External DPO engagements operate as multi-year flat-rate retainer contracts generating predictable recurring revenue. Project-based engagements (e.g., TISAX certification at €20,000–€60,000 per location) and training programs (CADAIS subscriptions, in-person seminars, Digital Safety Day) complement the retainer base. Distribution is exclusively direct: enterprise field sales, consultative engagement with German decision-makers, content marketing (blog, newsletter, earned media), and community programs. The firm is a member of TeleTrusT, BvD, GDD, DESAG, and BSG, reinforcing professional credibility in the German compliance ecosystem.

Name

EDV-Unternehmensberatung Floß GmbH

Legal name

EDV-Unternehmensberatung Floß GmbH

Website

https://floss-consult.de

Company type

Private

Founded year

1996

Operating status

Operating

Headcount range

1–10 employees

Short description

EDV-Unternehmensberatung Floß GmbH is a German consulting firm founded in 1996 specializing in integrated data protection (GDPR) and information security advisory, serving German SMEs, enterprises, and public institutions through external DPO retainers, TISAX/ISO 27001 certification, NIS-2 compliance, IT forensics, and its proprietary CADAIS online training platform.

Ownership category

akta.pro rank

Headquarters

HQ city

Versmold

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D, Others

Revenue model

1. Consulting Services: The primary revenue stream is consulting fees from data protection, IT security, and compliance advisory engagements. This includes project-based consulting, retainer contracts for ongoing advisory services, and one-off audit and assessment engagements. Revenue is generated through professional service fees billed at agreed rates or retainer.
2. External Data Protection Officer (External DPO): Companies contract the firm as their external Data Protection Officer under a contractual flat-rate fee arrangement. The firm provides continuous compliance support, reporting, and advisory services on an ongoing basis, creating recurring revenue from retainer-style engagements.
3. Training and Education: Revenue generated through structured training programs including video-based and in-person seminars on data protection and information security. Training covers basic data protection courses, refresher sessions, and specialized topics such as IT security, phishing awareness, and smartphone security workshops. CADAIS platform subscriptions also contribute to this revenue stream.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels5 records

Core offering

EDV-Unternehmensberatung Floß GmbH is a German consulting firm providing integrated technical, legal, and organizational data protection and information security services. Core offerings include external Data Protection Officer (DPO) retainer services, GDPR/DSGVO compliance consulting, IT security consulting, IT forensics, ISO 27001 and TISAX certification support, NIS-2 compliance advisory, and the CADAIS Deutschland online training platform. The firm serves enterprises, SMEs, courts, public prosecutor's offices, and insurance firms across Germany.

Product overview

EDV-Unternehmensberatung Floß GmbH is a consulting firm offering professional services in data protection, IT compliance, and information security. The company's portfolio consists of consulting services and training programs rather than software products. Core service areas include IT-Compliance, External Data Protection Officer, Data Protection Consulting, Data Protection Audits, Phishing Campaigns, Microsoft 365 GDPR Compliance, IT Forensics, ISO27001 & TISAX Certification, IT Expert Witness Services, IT Security Consulting, Security Assessments, Drone Attack Protection, NIS-2 Compliance, and Industry-Specific Solutions. Supporting offerings include CADAIS Deutschland (online training campus for data protection and information security), Digital Safety Day (school-focused digital safety), Smartphone Courses, and the Mit Sicherheit digital (home office security) service. The company operates as a services-based consultancy with no packaged software products.

Differentiator

Problem solved

Functional benefit

Brands

• CADAIS Deutschland: Campus für Datenschutz und Informationssicherheit - Online-Schulungen zu Datenschutz und Informationssicherheit für Mitarbeitende von kleinen und mittelständischen Betrieben sowie Konzernen.

Products and services

• External Data Protection Officer (Externer Datenschutzbeauftragter) Provides certified data protection officers available around the clock to help companies build and implement GDPR-compliant data protection management. Offered as a contractual flat-rate retainer (Pauschalhonorar) with multi-year engagement and no hidden additional costs.
• Data Protection Consulting (Datenschutzberatung) Professional consulting services for implementing data protection requirements, including data protection audits, GDPR compliance assessments, and support for establishing compliant processes for German businesses.
• Data Protection Audit (Datenschutzaudit) Systematic process to review and evaluate data protection practices ensuring compliance with GDPR through risk assessment, documentation, and reporting. Includes a published audit questionnaire and pricing guidance.
• IT Compliance (IT-Compliance) Ensures compliance with legal, industry, and internal IT requirements through analysis, measures definition, responsibility allocation, training, documentation, and monitoring.
• ISO 27001 & TISAX® Certification Support Support and guidance for companies through the certification process to achieve ISO 27001 and TISAX® certifications for information security management systems. Certification costs for one location are approximately €20,000–€60,000 depending on assessment level.
• IT Security Consulting (IT-Sicherheit Beratung) Practical IT security consulting including security concept development, SIEM systems, network segmentation, backup concepts, and secure authentication procedures for enterprises.
• Security Assessments (Sicherheitsüberprüfungen) Comprehensive security testing services including penetration testing, social engineering tests, perimeter security checks, and business continuity management implementation.
• IT Forensics (IT-Forensik) Methodical digital evidence analysis and court-admissible forensic investigation services to identify perpetrators, timelines, and scope of IT system incidents for use in legal proceedings.
• IT Expert Witness (IT-Sachverständiger) Certified IT expert services covering court testimony, private assessments, mediation, and arbitration proceedings for IT disputes. Served to courts, public prosecutor's offices, and insurance firms.
• NIS-2 Compliance Support for implementing EU NIS-2 Directive requirements including risk assessment, security policies, incident reporting, and business continuity planning.
• NIS-2 Applicability Assessment (NIS2 Betroffenheitsprüfung) Legal assessment service to determine whether companies fall under NIS-2 scope, combining IT consulting with legal advice from partner law firms for a legally binding determination.
• Phishing Campaign (Phishing Kampagne) Customized phishing awareness training programs including realistic phishing simulations to strengthen employee awareness and readiness against phishing attacks.
• Microsoft 365 and Data Protection Enables GDPR-compliant use of Microsoft 365 through tailored encryption technology where customers retain control over their encryption keys.
• Drone Attack Protection (Drohnenangriffe) Protection against drone-based threats through simulated drone flights, vulnerability identification, countermeasure development, and employee awareness training.
• Industry Solutions (Branchenlösungen) Sector-specific data protection and information security consulting services tailored for various industries including healthcare, trade, SMEs, associations, schools, corporations, pharmacies, and therapy practices.
• CADAIS Deutschland - Online Training Campus for Data Protection and Information Security Online learning platform providing high-quality training courses and seminars on data protection and information security for employees of small and medium-sized enterprises as well as corporations. Features video-based and live seminar formats.
• Training and Courses (Kurse & Schulungen) Practice-oriented training programs covering GDPR requirements, data protection basics, IT security awareness, and specialized topics for various industries.
• Digital Safety Day School-focused digital safety program teaching students, teachers, and parents secure handling of smartphones and internet-capable devices. Nationwide initiative founded by Thomas Floß in 2007.
• Smartphone Courses (Smartphone Kurse) Workshops on secure smartphone configuration covering security settings, voice assistant usage, app security, passwords, and public hotspot safety.
• Mit Sicherheit Digital Comprehensive digital security service addressing home office and mobile working data protection through VPN access, secure data exchange, and digital process integration.

Quantifiable outcome

• Up to €20 million in potential GDPR fines avoided through proper compliance
• +1 more outcomes

Named customers13 records

Segments7 records

Ideal customer profiles6 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature1 record

Partnerships

One partnership is on record.

• pitc-legal – Eckhardt Rechtsanwälte Partnerschaft mbBcoreStrategic or Co-development PartnerA strategic legal partnership providing clients with integrated legal and IT/data protection advisory services. The law firm provides legal depth complementing the firm's technical expertise, enabling legally binding NIS2 compliance assessments and data protection officer evaluations. The collaboration enables clients to receive comprehensive advice from a single source covering both technical IT/data protection consulting and legal analysis. The partnership is marketed as 'Gemeinsam für Ihre Sicherheit' (Together for your security).

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• TÜV Rheinland: Global testing and certification giant with significant information security and data protection service lines. Provides ISO 27001/TISAX certifications and compliance advisory as part of a much wider portfolio.
• msg systems AG: A large German IT consulting group with a dedicated security and compliance practice offering GDPR advisory, ISMS, and IT security consulting to enterprises and public-sector clients.
• Controlware GmbH: A larger German IT services and cybersecurity provider offering managed security, compliance consulting, and ISO 27001 advisory. Broader incumbent with overlapping data protection / IT security offerings.
• TÜV SÜD Management Service GmbH: A leading global testing, inspection, and certification body offering ISO 27001, TISAX, and data protection services. Larger incumbent with overlapping capabilities but operating as part of a much broader portfolio.

Direct peers

• Secorvo Security Consulting GmbH: A Karlsruhe-based consultancy focused on information security, IT governance, and data protection. Comparable in offering TÜV-certified training, ISMS consulting, and security advisory.
• Datenschutz Nord GmbH: A Bremen-based German consultancy offering external data protection officer services, GDPR audits, and information security consulting. Closely comparable in size, scope, and target segments (SMEs, healthcare, trade) to EDV-Unternehmensberatung Floß.
• DATATREE AG: A Cologne-based German consultancy specializing in data protection, information security, and ISO 27001 consulting for SMEs. Comparable in service mix and segment focus to Floß.
• UIMC Dr. Victor Dessecker: A Wuppertal-based German consulting firm specializing in data protection, compliance, and IT security. Comparable boutique German data-protection consultancy serving SMEs and mid-market.
• intersoft consulting GmbH: A Hamburg-based German firm providing data protection, IT security, and IT compliance consulting with a strong SME and mid-market focus. Directly comparable service portfolio including external DPO and ISMS support.

Regional players

• DQS Holding GmbH: A Frankfurt-based certification body offering ISO 27001, TISAX, and information security assessments. Comparable in the certification advisory domain though primarily operating as a certification body rather than ongoing DPO retainer provider.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/floss-consult

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about EDV-Unternehmensberatung Floß GmbH