Rico Kerstan · International advisory
And ready for what comes next.
I work with leaders on crisis management, information security, and AI-driven organizational change. A particular focus is helping international organizations translate European security and resilience requirements into operational practice.
I bring experience from high-security production, critical infrastructure audits, and executive crisis exercises. I also apply AI agents to the research, delivery, and software workflows in my own advisory practice.
Explore my backgroundExpertise
I develop crisis structures, escalation procedures, and business continuity arrangements, then work with teams to test them. My experience includes emergency drills at a financial institution, staff exercises for an international semiconductor group, and IT emergency management at a university.
For example: An executive exercise examines how a team builds its situation picture, assigns decision authority, and follows through on tasks across departments.
I connect security requirements with the procedures and evidence needed to meet them. My work includes information security management systems, critical infrastructure assessments, and audit preparation in healthcare, energy, security printing, and international industry.
For example: At Bundesdruckerei, I led a task force on new European Central Bank security requirements for banknote production, including process and IT analyses.
I have redesigned work in my own advisory business around AI agents, automation, and reusable knowledge. That experience informs how I work with leaders on their business model, the tasks agents can perform, and the authority people retain.
For example: I use agentic AI systems to organize specialized agents across research, delivery, documentation, and software development, with clear approval and intervention points.
INTERGRAF
I am an INTERGRAF Lead Auditor, and I advise and train organizations in the security printing industry. I translate security requirements into responsibilities, operating procedures, and evidence that teams can use in their daily work.
My Intergraf experienceSecurity management for security printers and manufacturers within the certification scheme’s scope.
Security management requirements for suppliers to the security printing industry.
I led the project to develop the information security chapter of the Intergraf Certification Requirements. At the Lyon certification workshop, I presented the Chapter B update.
I work on integrating AI requirements into security management, focusing on how AI use affects responsibilities, controls, and the evidence organizations need.
Working across borders
I help international organizations connect European security and resilience requirements with group-wide governance and local operational responsibilities.
European operations
Connect group policies with site responsibilities, incident management, and evidence. NIS2 addresses cybersecurity; CER addresses the resilience of critical entities. The applicable national rules determine the local obligations.
NIS2 framework ↗Products for the EU market
Translate relevant Cyber Resilience Act requirements into development, vulnerability handling, and technical documentation. Start with the product and the organization’s role in its supply chain.
Cyber Resilience Act ↗Groups with multiple locations
Develop common procedures and assign the national additions to the right teams. Make it clear which decisions belong to group management and which responsibilities sit with each local entity.
Critical Entities Resilience Directive ↗KRITIS is the German term for critical infrastructure. Applicable requirements depend on the entity, activity, product, and national implementation.
Selected Work
From crisis response to AI-assisted security work: approaches I build and use in practice.
Creator
Published methodThe operating model I developed for crisis teams, cyber incidents, IT emergencies, and business continuity. Defined roles, a shared problem-solving process, and decision records help teams coordinate their response and review it afterward.
Visit P-DRIVENCo-developer with Prof. Dr. André Röhl
Standards & methodsA shared project for organizational and municipal crisis resilience. It brings together C]ORE, M]ORE, and R3G to address governance, resilience capabilities, and the assessment of risks.
Visit Crisis ArchitectureDevelopment initiative
In developmentA project connecting crisis exercises with AI-supported simulation. My focus is how simulated developments can help teams practice decisions and examine their coordination.
Discuss exercise designConcept development
Working approachAn approach to examining business models under the influence of AI. I use the perspective of a challenger to question assumptions about the customer, the work, and how the business earns revenue.
Read the underlying perspectiveOpen repository
I publish reusable security and crisis-management workflows through KrisensicherOS. The repository brings together AI agent profiles, templates, and playbooks for ISMS routines, incident preparedness, and management reviews, designed for use in an organization’s approved AI environment.
Perspectives
Organizational Singularity is my perspective on how work, leadership, and business models change when AI agents perform and coordinate tasks. The practical question is where authority and accountability belong.
Read about Organizational SingularityBook
Organisation in agentischen Zeiten
German-language book · 2026
Miriam Büxenstein and I examine how agentic AI changes work, leadership, and organizational design. We address decision authority, knowledge management, and the responsibilities leaders need to define when AI becomes part of their operations.
Explore the bookContact
Tell me what your organization is facing, where you operate, and what you need to achieve.