35
Business management, business administration; All of the aforesaid services in the context of organisational and professional business consultancy and assistance in relation to the creation, introduction, implementation and ongoing assessment of organisational requirements, demands, regulations and procedures in connection with IT security and IT security technology, and of organisational frameworks to achieve comprehensive protection of internal and external data processing procedures, IT systems and business networks for ensuring and adhering to general business operations (IT governance); In particular all of the aforesaid services for credit institutes and insurance companies, and the customers and subsidiary companies thereof; All of the aforesaid services for conducting, attaining and maintaining protection of IT systems and data processing procedures necessary to business organisation institutions, and of business structures for determining, controlling, reducing and avoiding existing operative risks for business operations; All of the aforesaid services for the proper determination, limitation and control of existing remaining residual risks, including caused by specific business organisational conditions and events or interventions of all kinds, including caused by unauthorised access to IT systems and data processing procedures, uncontrolled processes in IT systems and data processing procedures, and uncontrolled data transfer within and external to IT systems, network structures within and external to business networks, and data processing procedures; Optimisation of in-house procedures, Organization consultancy and Documentation; All of the aforesaid services in compliance with legal and/or contractual specifications and standards for proper business management (compliance) and in connection with the management and monitoring of companies, determined primarily by legislators and/or business owners (corporate governance); Organisational management of business processes and organisational business consultancy, including in relation to IT governance and IT service management and in relation to the implementation of compliance requirements and demands; Organisational, professional business and specialist consultancy in the field of outsourcing the functions of legally required anti-money laundering officers, compliance officers in accordance with the German Securities Trading Act (WpHG, Wertpapierhandelsgesetz) and for minimum risk management system requirements, consultancy relating to the creation, optimisation, support and ongoing assessment of information security systems (ISMS); Professional business assistance in the context of the creation, assessment and evaluation (review) of audit conducting proposals in compliance with legal and/or contractual specifications and standards for protecting IT systems and/or IT applications; Professional business standard and special audits in the context of business management in accordance with applicable regulatory requirements (individually or in annual quotas); Professional business baseline assessments for risk-oriented processes; In particular all of the aforesaid services for core banking systems, databases, and data warehouses, IT emergency planning systems, partial or complete outsourcing of IT audits, contingency planning of audit services over a number of years (optimisation of internal auditing bodies), audit key points, including design of internal control systems, design and documentation of internal processes, the nature, scope and/or degree of risk of business activities; Professional business consultancy in relation to business management and organisation in the fields of assistance with information security officers, business continuity management and IT emergency planning, conducting of IT emergency exercises, development of concepts for IT security solutions in accordance with current legal specifications and current technical and organisational standards; All of the aforesaid services based on recognised security standards developed in-house in accordance with the specifications of current statutory regulations for IT and information security, conducting of security audits and penetration tests, service provider reviews, providing of computer emergency (computer emergency response team, CERT) services; Assumption of data protection officer functions and assistance for data protection officers in their areas of responsibility for companies, in particular credit institutes; Providing and conducting of data protection audits; All of the aforesaid services based on recognised security standards developed in-house, weak point and risk analyses, assistance in the implementation of suitable risk management measures; In particular all of the aforesaid services for assisting credit institutes, insurance companies and other companies in fulfilling data protection and statutory security obligations and legal specifications; All of the aforesaid services for supporting and guiding companies in the setup and implementation of a data protection safeguarding concept and suitable organisation of data protection in accordance with current legal specifications; Creation and further development of inspection plans for business organisation relating to money laundering prevention and fraud prevention; document filing [office functions], Namely assistance in organising documentation; Organisational consultancy (best practice recommendations) for avoiding IT security incidents and reducing existing and/or detected IT security and liability risks; Professional business system and risk analyses and assessments relating thereto; Company organisation, Namely assistance in establishing authorisation concepts; Professional business risk management, namely partial or complete outsourcing of IT audits, contingency planning of audit services over a number of years (optimisation of internal auditing bodies), audit key points, including design of internal control systems, design and documentation of internal processes, the nature, scope and/or degree of risk of business activities; All of the aforesaid services being provided in electronic or non-electronic form
38
Providing access to computer programs, databases, IT systems of all kinds and/or data networks
41
Providing of training, arranging of seminars and training courses; All of the aforesaid services in the fields of creating, assessing, evaluating and implementing requirements, regulations and procedures to protect data processing and security procedures and to protect the devices for conducting data processing procedures and the technical-organisational and/or data protection-related and security-related devices therefor, said devices being for avoiding technical and operative risks; In particular all of the aforesaid services for credit institutes and insurance companies and the customers thereof; Statutory data protection training courses and instruction for employees; Arranging and conducting of training courses, seminars and congresses, in particular on the subjects of data protection, information security, precautionary clarification (awareness), compliance, IT auditing, money laundering prevention and fraud prevention; All of the aforesaid services being provided in electronic or non-electronic form
42
Scientific, technological and industrial analysis, research and consultancy in connection with requirements, regulations and procedures for protecting data processing and IT security processes and for protecting the technical devices necessary for conducting data processing procedures, said devices being for avoiding technical and operative risks; In particular all of the aforesaid services for credit institutes and insurance companies and the customers thereof; Technical and scientific consultancy in the context of the introduction, implementation and ongoing assessment of protected data processing procedures and IT systems for ensuring and adhering to general business operations based on IT security and data protection audits; Scientific, technological and industrial system and risk analyses and assessments, and auditing (quality control); Scientific, technological and industrial consultancy and support in the development, setup, introduction, implementation, ongoing assessment and adjustment of business organisation based on IT security-related, legal and organisational specifications and principles; Consultancy in the context of designing, creating, revising and adapting websites, databases, other operating systems and programs in connection with security and compliance management systems; Technical consultancy (best practice recommendations) for avoiding security incidents and reducing security and liability risks; Technical consultancy relating to the creation, optimisation, support and assessment of information security systems (ISMS); Technical consultancy in relation to conducting data protection audits, security audits, compliance audits and audit support, including in the course of money laundering prevention and fraud prevention; Technical consultancy with regard to conducting audits; Technical consultancy in relation to information security issues, data security issues and data protection issues; Quality control and/or testing; All of the aforesaid services comprising scientific, technological and industrial special audits in compliance with applicable regulatory requirements (individually or in annual quotas); In particular all of the aforesaid services for core banking systems, databases, and for analysis purposes, optimised central databases amalgamating and compressing data from a number of generally heterogeneous sources (integration and transformation) (data warehousing), quality control and testing, namely auditing of external service providers in connection with data protection aspects, in particular in accordance with respective current legal specifications for assessment and audit activities, support for internal data protection officers; Technical classification, technical evaluation and technical auditing of information technologies; IT security, namely consultancy and assistance for information security officers; IT security, namely consultancy and assistance in business continuity management and IT emergency planning, conducting of IT emergency exercises, development of concepts for IT security solutions in accordance with current legal specifications and current technical and organisational standards; In particular all of the aforesaid services based on recognised security standards developed in-house in accordance with the specifications of current statutory regulations for IT and information security, conducting of security audits and penetration tests, service provider reviews, providing of computer emergency (computer emergency response team, CERT) services; IT security, namely providing and conducting of data protection audits, including on the basis of recognised security standards developed in-house, weak point and risk analyses; IT security, namely assistance in the implementation of suitable risk management measures; IT security, namely assistance for credit institutes, insurance companies and other companies in the course of fulfilling data protection and statutory security obligations and legal specifications; Development of risk analysis tools, including web-based, and compliance management systems for supportive guidance relating to money laundering prevention and fraud prevention using internal or external implementation solutions; Computer hardware and software design and development for the aforesaid purposes included in class 42; All of the aforesaid services being provided in electronic or non-electronic form
45
Legal services in the fields of data protection, compliance, information security and company officer duties (data protection, information security, money laundering and compliance), service provider management; All of the aforesaid services in compliance with legal specifications, regulations and procedures for protecting data processing and IT security procedures and for protecting technical devices necessary for conducting data processing procedures, the aforesaid devices for avoiding technical and operative risks; In particular all of the aforesaid services for credit institutions and insurance companies, and the customers thereof; Legal consultancy (best practice recommendations) for avoiding security incidents and reducing security and liability risks; Legal consultancy in relation to the creation, optimisation, support and assessment of information security systems (ISMS), data protection concepts; Legal consultancy in relation to conducting data protection audits and compliance reviews; Legal consultancy with regard to conducting audits, legal consultancy relating to information security and data security issues, and data protection; Legal consultancy in relation to IT security in the creation and further development of inspection plans relating to money laundering prevention and fraud prevention; All of the aforesaid services being provided in electronic or non-electronic form