Younes Ahmadzei
Younes Ahmadzei is an Information Security Consultant focusing on practical NIS-2 implementation, evidence-based security assessments, and translating ISO/IEC 27001 and TISAX/VDA ISA structures into actionable improvements for SMEs.
His work on NIS-2 has included outreach to 1,800 German SMEs, 17 semi-structured interviews, and the development of a pragmatic self-assessment model. He has presented his findings at BSides Munich, Elbsides, and the BSI IT Security Congress. His current work also explores how local LLMs can support the analysis of ISMS documents and security evidence while keeping final assessment decisions with human experts.
Sessions
Many security assessments end with a simple “yes” or “no”. Yet “yes” may mean that a policy exists, that someone believes a process is followed, or that operational evidence demonstrates the measure actually works.
In this four-hour workshop, participants become the assessment team for “Musterwerk 180”, a fictional German SME. Working in small groups, they will review synthetic policies, responsibilities, incident records, backup logs, test results, risk information, and management records. Using a simple assessment lens - claim, design, operation, and effectiveness - they will evaluate selected NIS-2 security measures, identify missing or contradictory evidence, formulate targeted follow-up requests, and prioritise practical improvements.
The workshop covers three cases: backup and recovery, incident handling and reporting, and cybersecurity governance. It requires no coding and no detailed knowledge of individual standards.
Participants will leave with a reusable evidence-assessment worksheet, a structured method for requesting better evidence, and an approach for turning assessment findings into a prioritised improvement plan.
Many NIS-2 readiness assessments end with a spreadsheet full of Yes/No answers. But three different organisations can all answer “Yes, we have backups” while one has only a policy, another has job logs, and only the third can demonstrate a successful restore. The checkbox is identical; the level of confidence should not be.
Drawing on exploratory research with German SMEs and practical work across NIS-2, ISO/IEC 27001 and TISAX/VDA ISA, this talk examines the gap between a claimed control and evidence that it works. Relatable examples from backup and recovery, incident handling and security governance show how assessments can confuse documentation, operation and effectiveness.
The talk introduces a simple four-part evidence lens—claim, design, operation and effectiveness—and a five-question “evidence survival test”. Neither is presented as an official framework; both are practical tools for asking better questions. Attendees will learn how to spot unsupported claims, request meaningful evidence and translate assessment gaps into prioritised security improvements.