Manipulation risks during transmission, such as forged senders or manipulated bank details, pose a significant threat. Emails are easy to forge, and cybercriminals exploit this to inject malware or redirect payments. 

For example, a medium-sized company received a seemingly legitimate invoice from a long-standing supplier by email, with the correct logo and contact person. However, the bank details had been manipulated. The fraud was only discovered weeks later. The cause was a lack of authentication of the sender address and insufficient verification of payment data. 

Another negative example is a municipal company that processed e-invoices on a server whose operating system had not received security updates for years. A targeted attack via a known vulnerability led to the encryption of all invoice data by ransomware, including archived data. Recovery took weeks. 

The processing and archiving of digital invoices also present challenges for companies. Systems must meet legal requirements arising from Value Added Tax Acts and the GDPR, while also being technically secure. 

Before technical measures are taken, a systematic assessment of the existing IT and communications infrastructure is essential. Our as-is analysis forms the basis for all further steps. This involves assessing and evaluating the systems, transmission channels, and organizational processes used in terms of information security, cybersecurity, and compliance.  

A particular focus is on whether the systems meet the requirements for confidentiality, integrity, availability, and traceability, which are central principles of secure invoice processing. The communication channels used (e.g., email, Peppol, SFTP) are also assessed for their security and resistance to manipulation. 

Based on the jointly conducted as-is analysis, targeted measures can then be derived, such as the introduction of secure transmission protocols, hardening of IT systems, implementation of a proper change management process, implementation of access controls, or the selection and monitoring of suitable external service providers. 

After the as-is analysis, the client receives a documentation of results that includes: 

• the results of the assessment of the IT and communications infrastructure 
• an evaluation of the resources used in terms of security, compliance, and efficiency 
• concrete recommendations for improving digital invoice processing and minimizing risks