What is an ISMS tool?

An ISMS tool is software you use to run your information security management system. Assets, risks, policies, controls and audits sit in one place and are linked to each other. It is also called ISMS software.

Why use an ISMS tool instead of Excel?

In spreadsheets, links, versions and owners get lost quickly. An ISMS tool links each risk to the asset it affects and to its controls, reminds you of review dates and records every change. In the audit, you find evidence without searching.

Which standards is SecTepe.Core suited for?

ISMS management is built for ISO 27001, with the Annex A catalog and the statement of applicability. For risks, you can also use the BSI 200-3 method. Core covers other standards such as NIS2 or SOC 2 through its multi-framework assessments.

Who can change a risk?

Anyone with the right role can propose a change. If that person is not the risk owner, the change waits. It only takes effect once the owner approves it.

What happens to the history when a risk is deleted?

Core logs each creation, update, status change and deletion. It records who made the change. This history stays, even after the risk itself is gone.

Can I get my data out?

Yes. Assets, risks, controls and policies each have an XML export.

SecTepe.Core

ISMS

ISMS Managementin one platform

SecTepe.Core puts each part of your ISMS in one place: assets, risks, policies, controls and audits. Each item has versions and links to the rest. So you are ready for an audit at any time. Core is an ISMS tool and risk management software in one.

Request a demo

What you get

Asset lifecycle
Risk register with CVSS
Policy repository
Control monitoring
Audit workspace
Evidence linking

Features at a glance

Each part of your ISMS in one platform, from the first asset to the audit.

Asset Lifecycle Management

Record, classify and track each asset over its whole life. That runs from the day you buy it to the day you retire it.

Risk Register

One central risk register with CVSS scores and a heat map. Treatment plans name an owner. The risk owner signs off on changes.

Policy Management

Write, approve, publish and revise policies, with versions. Read receipts show who has read and confirmed them. Fixed review cycles show when the next review is due.

Control Tracking

See how each control works in daily use. Each one has a status, an owner, evidence and fixed review dates. Reminders go out by themselves.

Audit Collaboration

Auditors, consultants and your own teams work in one shared space. It holds tasks, comments, chat and a store for evidence.

Reporting & KPIs

Dashboards for managers, auditors and the ops team show KPIs and trends for risks, controls, policies and audits. You can export them.

Your benefits

Too many separate tools slow your ISMS down. SecTepe.Core brings each module into one platform. Your team spends less time switching tools and more time on security.

One source of truth for assets, risks and controls
Linked data: evidence, risks and controls point to each other
Ready for audits, with full versions and history
Less manual work thanks to reminders and set workflows
Clear dashboards for managers and auditors

Use cases

ISO 27001 operations

Run your ISMS day to day in one tool: plan, do, check, act. It spans risk treatment all the way to the management review.

Risk treatment plans

From each risk you identify, you derive measures. Core tracks them until they are done.

Rolling out new policies

Roll out new policies across the company. Staff confirm them online, and a report shows the status.

Internal and external audits

Auditors get their own workspace with evidence, controls, documents and the history. No more back-and-forth by email.

How ISMS Management works in practice

SecTepe.Core keeps assets, risks, controls and policies in one database. Records point to each other. So you can trace a risk back to the asset it affects. You also see which controls treat it.

How the building blocks fit together

Assets have a type, an owner and a custodian. You rate confidentiality, integrity and availability from 1 to 5. From these values, Core works out how critical the asset is overall.
Risks get a likelihood and an impact from 1 to 5. Core calculates the risk level. You decide: reduce, transfer, avoid or accept. Residual values show the state after treatment.
Controls carry an ISO 27001 reference, a type and a status. You can load the ISO 27001 Annex A catalog in German or English.
Policies move from draft to review to approved. Core keeps every version. Staff confirm or decline the policies assigned to them.

Typical scenarios

ISO 27001: Load Annex A and mark each control as applicable or not, with a reason. Then export the Statement of Applicability (SoA) to PDF, Excel or Word.
BSI IT-Grundschutz: For each risk, you pick ISO 27005 or BSI 200-3 as the method. With BSI 200-3 you link a threat from the BSI catalog and set the protection need. Assets also get suggestions from that catalog.
Internal audits: On request, Core drafts a three-year ISO 27001 audit program.
Reviews: Each policy has a review cycle, 12 months by default. Overdue reviews appear in their own list.

Operation and data sovereignty

You can host SecTepe.Core yourself. It runs in containers on your own servers or on Kubernetes. It also runs in networks with no internet access. Each record belongs to exactly one tenant. The AI runs at IONOS in German data centers, on SecTepe GPU servers or on your own GPU server. Core will not start if any other AI provider is set.

Questions about the ISMS tool

What is an ISMS tool?: An ISMS tool is software you use to run your information security management system. Assets, risks, policies, controls and audits sit in one place and are linked to each other. It is also called ISMS software.
Why use an ISMS tool instead of Excel?: In spreadsheets, links, versions and owners get lost quickly. An ISMS tool links each risk to the asset it affects and to its controls, reminds you of review dates and records every change. In the audit, you find evidence without searching.
Which standards is SecTepe.Core suited for?: ISMS management is built for ISO 27001, with the Annex A catalog and the statement of applicability. For risks, you can also use the BSI 200-3 method. Core covers other standards such as NIS2 or SOC 2 through its multi-framework assessments.
Who can change a risk?: Anyone with the right role can propose a change. If that person is not the risk owner, the change waits. It only takes effect once the owner approves it.
What happens to the history when a risk is deleted?: Core logs each creation, update, status change and deletion. It records who made the change. This history stays, even after the risk itself is gone.
Can I get my data out?: Yes. Assets, risks, controls and policies each have an XML export.

Ready for integrated ISMS management?

See how SecTepe.Core makes your ISMS simpler and keeps it ready for audits at all times.

Request a demo Back to SecTepe.Core

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.