Introducing an ISMS – step by step to the certificate.
We support your ISMS from the first scope through to external certification. Our method is clear and easy to plan. We do not just give advice. We also do the work.
When you need an ISMS
Usually the push comes from outside. By then, the timeline is already set.
Customers and the supply chain ask for proof
More and more contracts and supplier forms ask for the certificate. Without it, you drop off the shortlist. Nobody even looks at your offer.
NIS2 puts the obligation on management
Article 21 calls for suitable steps to manage risk. The duty sits clearly with the leadership. An ISMS helps you meet it in an orderly way, and prove it.
TISAX in the automotive supply chain
Do you handle design or prototype data from carmakers? Then you need the TISAX assessment. Much of it can build on ISO 27001. You do not have to set it up separately.
Insurance and public tenders
Cyber insurers and public buyers want to see proven processes. A list of installed products is no longer enough. An ISMS gives you exactly that proof.
What we take on
Six work packages. You decide which ones you keep in-house.
Scope and first review
We set the scope and find out who is involved. Then we compare with the chosen standard. You get a list of what is missing. You also see what you already have under another name.
Risk method and inventory
A method your team will still use after the audit. Plus a list of your assets, such as systems and data, and how much protection each needs. Not a spreadsheet monster nobody touches once certified.
Documentation
Policy, guidelines and procedures based on proven templates. We adapt them to your business. You do not get a loose pile of boilerplate.
Putting safeguards in place
We support the technical and organisational safeguards. We do the work, coordinate providers or steer your team. It depends on what works for you.
Awareness and training
We build the training plan, make the material and run the first round. We prove it works in a way that holds up in the audit.
Certification preparation
Internal audit, a review by management and a trial audit with an external body. At the certification audit, we sit at the table with you.
The road to the certificate
Six phases that build on one another. How long it takes depends on scope and where you stand. We estimate it after the first review, not before.
First review
Where do you really stand? We compare with the standard. You get an honest list of gaps and a rough estimate of the work.
Scope and policy
Put the scope in writing. Management signs off the policy. Roles and duties are named.
Risk analysis and inventory
We list your assets and how much protection they need. Then we assess and treat the risks. This step takes the most time and matters most.
Documents and safeguards
Write guidelines, put safeguards in place, collect proof. This mostly runs alongside the previous step.
Internal audit and management review
Check yourselves before someone else does. Fix the findings, prove it works, involve the leadership.
Certification audit
Stage 1 checks the documents. Stage 2 checks daily practice. We support both and the follow-up.
ISO 27001 or BSI IT-Grundschutz?
The answer depends on your customers and your sector, not on what the consultant likes.
| ISO 27001:2022 | BSI IT-Grundschutz | |
|---|---|---|
| Recognition | International, for any sector | German-speaking region, strong in the public sector |
| Level of detail | A framework; how you fill it is up to you | Very concrete modules and requirements |
| Who typically asks for it | Customers, tenders, the supply chain | Public authorities, critical-infrastructure operators, public buyers |
| Certification body | Accredited bodies such as DEKRA, TÜV, DQS, DNV | Auditors certified by the BSI |
| Counts towards NIS2 | Covers a large part of Article 21 | Covers Article 21, with much more detailed rules |
What you get
- An ISMS manual that describes your organisation rather than a model company
- A risk register with a method your people can carry forward
- A Statement of Applicability (which safeguards apply to you)
- A complete set of policies, cut to your processes
- A training programme with proof that it works
- An internal audit report and documented readiness for certification
Who fills the role
An ISMS needs someone in charge. If you lack that person, we take on the role of information security officer. We do it from outside and apart from your IT operations.
External information security officerTooling instead of spreadsheets
Want software to track the requirements? SecTepe.Core is our ISMS and GRC platform, built in the EU. You do not have to use it. An ISMS works without our product too.
View SecTepe.CoreFrequently asked questions
- How long does introducing an ISMS take?
- That depends mostly on the scope. It also depends on how much you have already written down. A small company with a clear scope moves much faster. Several sites with different processes take longer. After the first review, we give you a timeframe you can plan around, not a guess.
- ISO 27001 or BSI IT-Grundschutz?
- ISO 27001 is recognised worldwide and fits any sector. It is the right choice for most firms, above all when customers or tenders ask for the certificate. The BSI IT-Grundschutz goes into more detail and follows German practice. Public bodies, critical-infrastructure operators and the public sector often expect it. We decide this with you based on your customers, not on our taste.
- How much work falls on our side?
- Most of the work sits in risk analysis, writing documents and putting safeguards in place. That is where we need your experts. Only they know how your processes really run. We bring the method, templates and structure. So your people do not start from a blank page. We estimate the exact effort after the first review.
- What does external support cost?
- It depends on the scope, where you stand today and how much you want to do yourselves. We start with a free call. Then you get a quote with clearly defined work packages. Terms on request.
- How much does ISO 27001 certification cost?
- The cost is made up of several parts. The certification body charges for the audit days. How many there are depends mainly on the number of staff and the scope. On top of that come your internal effort, external consulting if needed and the cost of missing measures. Also plan for the yearly surveillance audits. You get a reliable estimate for your company after the initial assessment.
- How long is an ISO 27001 certificate valid?
- A certificate is valid for three years. During this time, the certification body checks every year in a surveillance audit whether the ISMS still works. After three years, recertification follows.
- Do we get the certificate from you?
- No, and that is how it should be. We give advice. Accredited bodies such as DEKRA, TÜV, DQS or DNV issue the certificate. Anyone who both advises and certifies has a conflict of interest. We prepare you for the audits and sit at the table with you.
- Does an ISMS count towards NIS2?
- An ISMS to ISO 27001 covers a large part of Article 21 of NIS2. That article deals with how you manage risk. We use a mapping that links each NIS2 duty to a safeguard. It also shows where something is still missing.
- We already have an ISMS that does not work. Can you help with that?
- Yes. A stalled ISMS does not need a fresh start. It needs an honest review. What is useful? What is just paper? Where does the organisation get stuck? Then we rework it and keep whatever holds.
Let us draw your ISMS roadmap.
In a workshop, we go through your goal, the standard and the timeline. It is free and without obligation.
Request a roadmap workshopHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.