ISO 27001 consulting: build an effective ISMS

From gap analysis to audit preparation: we help you establish information security under ISO/IEC 27001 throughout your organisation.

Strengthen information security and manage risks in a comprehensible manner.

Learn more

Information security

An Information Security Management System (ISMS) combines responsibilities, risk assessment and security measures. Our ISO 27001 consultancy supports companies and public organizations in setting up and further developing this system – in line with their business model and protection needs.

Together we clarify the scope, evaluate existing processes and plan the next implementation steps. Guidelines, evidence, training and internal audits should work in everyday work and prepare an independent certification.

For the selection and prioritization of technical protection measures, our IT security consultancy services The right way to start. We combine several standards in one Integrated management system.

How we support you with our ISO 27001 consultancy

In a free initial consultation, we first record your specific needs. On this basis, we develop an individual package of measures that is optimally tailored to the requirements of your company.

Our offer includes the implementation of an information security management system, either according to ISO 27001 or according to the automotive standard TISAX® (TISAX® is a registered trademark of the ENX Association). In addition, we provide you with comprehensive advice on compliance with the requirements of the NIS 2 Directive and the DORA regulations.

Depending on the focus, we also support you in the implementation of the modernized BSI standards, which include both a general management system for information security as well as the IT basic protection methodology and the core assurance of particularly sensitive data. Upon request, we also take over the training of your employees in order to anchor a holistic security awareness in the company.

Their advantages

Benefit from our cooperation

Security

The security of your data deserves the highest attention. An information security management system offers you comprehensive protection against misuse and theft.

Speed

Proven methods and standardized processes ensure that existing regulatory gaps in your system are quickly closed.

Customer trust

A high level of information security leads to a trusting relationship between you and your customers. 

Integrative approach

We either integrate the new regulations into your existing documentation systems or provide you with a collaboration platform.

Personal support on site

Unlike many of our competitors, we are personally at your side whenever you need us.

Process of your ISO 27001 consultation

Our experienced IT security consultants are very familiar with the risks, opportunities and compliance requirements of SMEs, companies and authorities. We advise you across industries, our consultants have many years of experience in many areas such as B. NIS2, banking and insurance, KRITIS, telecommunications, health sector etc. Take advantage of our specialized advice to ensure that your company benefits from optimal protection against potential threats.

1. Setup

We work with your management and IT teams to define the necessary protections, taking into account the potential risks of your business. Our goal is to create a tailor-made security concept that meets both the requirements of the industry and your goals such as ISO/IEC 27001, TISAX® or IT basic protection standards.

2. Analysis

Our experienced technical team thoroughly examines your IT, infrastructure and interfaces to determine the necessary security requirements. We go beyond the traditional measures to verify compliance with IT regulations and give you the assurance that there is a comprehensive risk assessment based on industry best practices.

3. Concept

Based on your requirements, we create an IT security concept. We are developing a comprehensive approach that identifies suitable options for implementation. You have the last word!

4. Solution

All necessary measures – from short-term to long-term security measures – are developed and carefully implemented. Technical aspects are seamlessly combined with organisational, human and infrastructural considerations to ensure maximum protection against the identified risks.

5. Reporting

Our experienced team ensures that you receive the best support when converting to a productive operation – for the success of everyone involved! In addition, we offer regular reports with appropriate documentation as well as special communication channels such as status reports, so that vulnerabilities can be resolved quickly and you are always up-to-date.

6. Advisory services

With a continuous improvement process (CIP), ongoing monitoring ensures that the IT security concept is always up-to-date. Regular analysis of implementation and defined performance indicators (KPIs) enables us to respond to vulnerabilities or to use newly identified security gaps for further optimization. We offer you comprehensive strategic end-to-end support in the field of information security – from initial planning to successful implementation. Our team is at your side as a reliable partner and consultant.

Frequently Asked Questions on Information Security, ISMS & ISO 27001

What is meant by information security?

Information security deals with the protection of all information that exists in an organization – this includes Digital data, Paper documents, Employee knowledge and other confidential information. The overarching goal is to: Confidentiality, Integrity and Availability the information to be provided.

  • Confidentiality means that only authorized persons have access to information.
  • Integrity refers to the fact that information is correct and complete and is not changed unauthorized.
  • Availability ensures that information and systems are accessible when necessary.


Note: Especially in times of increasing cyber threats and complex legal requirements, the topic of information security is becoming increasingly important. External consulting can help companies develop tailor-made security concepts both strategically and operationally.

An ISMS is an Structured approachto plan, implement, monitor and continuously improve information security in an organization holistically. It shall consist of: Policies, processes, procedures and controlsto ensure that information security objectives are met and risks are adequately addressed.

Typical components of an ISMS are:

  1. Information security policyBasic guidelines and objectives.
  2. Risk management process: identification, evaluation and treatment of risks.
  3. Roles and responsibilities: Definition of who is responsible for what.
  4. Training and awareness raising: So that all employees understand the importance of information security.
  5. Control measures: technical, organisational and physical security measures.
  6. Processes for continuous improvement: Regular reviews and audits.


Note: External advice can significantly speed up the process and ensure that best practices are applied.

The ISO/IEC 27001 is the Globally recognized standard for the implementation and operation of an ISMS. It specifies requirements that organizations must meet to implement certified information security management.

  • The ISO/IEC 27001:2022 version Includes updated requirements and controls to meet modern IT and information security challenges.
  • It is part of the ISO/IEC 27000 family, which covers various aspects of information security.


Certification according to ISO/IEC 27001:2022 offers companies Objective evidencethat they use best practices and adopt a systematic approach to information security. This strengthens the trust of customers, business partners and regulatory authorities.

Note: External consultants are often familiar with the latest changes and interpretations of the standard and can help to adapt the ISMS quickly and in accordance with the standards.

Compared to the previous version (ISO/IEC 27001:2013), there are some major innovations:

  1. Adjustments to Annex A:
    • Controls were summarized, restructured and adapted to modern technologies (e.g. B. Cloud, mobile devices) adapted.
    • New controls have been introduced on topics such as threat intelligence, configuration management and cloud services.
  2. Strengthening of the risk treatment process:
    • Clear guidelines for defining and evaluating risks.
    • Detailed documentation and traceability requirements.
  3. Stronger involvement of top management:
    • The responsibilities for information security and risk management will be anchored even more intensively at the top management level.
  4. Updated terminology and improved clarity:
    • Modernised terms and more precise formulations provide a better understanding.


Note: Those who are already certified according to ISO/IEC 27001:2013 should check at an early stage which adjustments are necessary to maintain the certificate according to ISO/IEC 27001:2022. External advice can help to minimize the conversion effort.

Certification according to ISO/IEC 27001 has a number of advantages:

  • Trust-buildingCustomers, partners and authorities see that information security is implemented professionally.
  • Competitive advantage: Many tenders and cooperation partners require demonstrably high security standards.
  • Risk minimisation: An ISMS helps to systematically detect and correct vulnerabilities.
  • Facilitating complianceA certified ISMS supports the fulfilment of other regulatory requirements such as NIS2, DORA, IT Security Act and GeschGehG.


Note: External consulting can support in particular in the preparation for the certification audit by specifically identifying gaps and introducing best practices.

The NIS2 Directive (Network and Information Security Directive) is an EU-wide regulation that replaces the previous Directive (NIS) and tightens its provisions. It expands the circle of companies that as Significant or significant entities It sets higher standards for cybersecurity.

  • Reference to ISO/IEC 27001:
    • A structured ISMS in accordance with ISO/IEC 27001 makes it easier for organizations to comply with the requirements of the NIS2 Directive (e.g. B. risk management, reporting security incidents.
    • The standard provides a systematic framework for establishing processes and technical controls to counter cyber threats.


Note: External experts are familiar with the interfaces between the ISO standard and legal obligations and support tailor-made implementation.

DORA (Digital Operational Resilience Act) is an EU regulation aimed specifically at the financial sector and the Protection against cyber risks as well as the Maintaining Critical Financial Services It is to be ensured throughout the EU.

  • Central content:
    1. Risk management in the financial sectorFinancial institutions must meet strict requirements in order to prepare themselves against cyber threats.
    2. Reporting requirements: Security incidents must be reported to the competent authorities in a timely manner.
    3. Exchange of information: Encourage the exchange of cyber incidents between financial institutions.
  • Relevance to ISO/IEC 27001:
    1. An ISMS forms the basis for a structured approach to risk identification, assessment and treatment, which is also necessary for the requirements of DORA.
    2. The documentation requirements in ISO/IEC 27001 support compliance with DORA requirements.


Note: External consulting can be helpful especially in the financial sector, because in addition to ISO/IEC 27001, often additional standards (e.g. B. BAIT, EBA guidelines are relevant.

The German IT Security Act – and its further developments (e.g. B. IT Security Act 2.0 – specifies that Critical Infrastructure Operators (KRITIS) and other key organizations must adequately protect their IT systems.

  • Requirements:
    • Implement security standards and reporting obligations in the event of security incidents.
    • Regular audits and audits by the Federal Office for Information Security (BSI).
  • Why important?
    • Violations can lead to high fines, loss of image and strict conditions.
    • Companies must demonstrate that they are applying the “state of the art”.


Note: ISO/IEC 27001 certification is often accepted as proof of compliance with the state of the art. External consultants can assist in the implementation of BSI recommendations and standards.

The Law for the Protection of Trade Secrets (GeschGehG) is intended to protect sensitive operational information – i.e. trade secrets – from unauthorized disclosure or use. Companies shall: technical, organisational and contractual measures to secure their know-how.

Interaction with an ISMS:

  • An ISMS according to ISO/IEC 27001 already specifies many measures that also serve the protection of trade secrets (e.g. B. Access permissions, encryptions, clear processes.
  • Companies can prove so efficiently that they adequately protect their secrets.


Note: An external consultancy can help, for example, to classify guidelines, establish processes of secrecy protection and design the documentation in the ISMS in such a way that the requirements of the GeschGehG are met.

The certification process is divided into several stages:

  1. Project initiation and scope definition:
    • Determine which areas and locations are included in the ISMS.
  2. Risk management:
    • Identification, evaluation and treatment of risks.
    • Selection of appropriate controls (according to Annex A of ISO/IEC 27001:2022).
  3. Implementation of measures:
    • Implementation of policies, processes and technical security solutions.
    • Awareness raising of employees.
  4. Internal audits:
    • Examination of the effectiveness of ISMS by internal auditors.
  5. Management assessment:
    • Review by the management whether the ISMS meets the defined goals.
  6. Certification audit:
    • An external certifier checks the conformity and issues the certificate.


Note: External consultants can assist not only in the implementation, but also in the preparation for the audit – for example through pre-audits (gap analyses) and training.

The duration depends greatly on the Size size, Complexity and the Existing maturity an organisation from:

  • Smaller enterprises With manageable processes, the process can be carried out in approx. 6–12 months run through.
  • Medium and large enterprises or corporations with complex structures and many locations often require 12-24 months or longer.


Important factors are such as the Availability of resources, which Commitment of top management and the Training needs.

Note: Through targeted project planning, an external ISMS consultant can help to shorten the time required by identifying and avoiding typical stumbling blocks at an early stage.

The costs shall consist of the following components:

  • Internal expenses: Staff costs for the project team, training, internal audits, etc.
  • External advice: Fees for ISMS experts and special consulting services, if purchased.
  • Certification costs: Fees of the certification company (depending on company size, audit duration).


Generally, the cost input increases with the Size of enterprise and Complexity. Nevertheless, it should be noted that this investment in information security Long-term Reduced costs due to security incidents, fines or image loss.

The risk-based approach is a core principle of ISO/IEC 27001. It states that security measures are always Targeted and Proportionality must be to the identified risks. In this case, in a defined Risk management process Threats, vulnerabilities and damage impacts are analyzed to derive prioritized actions.

  • Risk assessment: Which risks have a high probability of occurrence or a high potential for damage?
  • Risk treatmentWhat controls or strategies are used to minimize or accept these risks?
  • Continuous processRisks are constantly changing, so a regular reassessment is necessary.


Note: External consulting can help to select meaningful risk assessment methods and tools and integrate them into company processes.

Resource shortage: Often there is a lack of sufficient qualified staff and time to deal intensively with the norm and risk management.

Resistance in the company: Employees sometimes perceive the additional documentation effort as bureaucracy.

Lack of safety culture: If top management does not actively exemplify and communicate the importance of information security, the topic often falls by the wayside.

Technical complexityHeterogeneous IT landscapes, legacy systems and cloud services can make implementation more difficult.

Note: As a neutral entity, external consultants can mediate internally, design training programmes and propose organizational and technical solutions.

The top management sets the Strategic orientation establishes and establishes the Necessary resources available. In addition, it creates the Corporate culture, has a high priority in the field of information security. If the executives are behind the ISMS and communicate this visibly, acceptance increases throughout the company.

Examples of management tasks:

  • Definition of the Safety objectives and directives.
  • Decision on: Risk budgets and strategies.
  • Communication the importance of safety measures for all employees.


Note: The certification audit explicitly checks whether top management is involved and assumes responsibility. External consultants can hold workshops with leaders to clarify the role of management.

The Statement of Applicability (SoA) is a central document in ISO/IEC 27001, which states:

  1. What are the controls? (from Annex A or additional) for your own ISMS as applicable applicable.
  2. What controls are excluded have been; and Why (e.g.) B. because certain risks do not apply.
  3. Justification the selection or rejection of specific measures.


It serves as Transparency and demonstration document for internal and external stakeholders (e.g. B. Auditors, customers, partners. Based on the SoA, it is possible to understand which security standard the company strives for and implements.

Note: An external consultancy can assist in the preparation of the SoA by assessing which controls are appropriate or critical and by structuring the documentation in a uniform manner.

With the ISO/IEC 27001:2022-Version of the Annex A has been revised. This requires a Update the SoA to ensure that the new, amended and merged controls are correctly taken into account. Importantly,

  • Mapping the old controls on the new or changed controls.
  • Adaptation the justifications, if the requirements or the risk situation have changed.
  • Documentation all changes with clear traceability for internal and external audits.


Note: External advice can facilitate the transition by explaining the changes in the standard and supporting the migration process.

In fact, it's highly recommended. Integrated management systems (IMS) to be established. ISO standards often share common principles:

  • Process-oriented approach
  • Risk-based thinking
  • Continuous improvement

Examples of synergy effects:

  • A company that already has Quality management system (ISO 9001) has established structures for process documentation and internal audits.
  • One Business continuity management system (ISO 22301) and an ISMS complement each other to cover failure scenarios and minimize their impact.


Note: External consultants who have experience with several standards can ensure that documentation and processes do not have to be duplicated and uniform governance is created.

NIS2 requires companies (especially critical sectors) to maintain a high level of IT and cybersecurity and reports of security incidents. With an ISMS, organizations can more easily meet these requirements because:

  • Risk assessments and safety measures have already been formalised.
  • Incident management is clearly defined, which facilitates reporting to authorities.


DORA Calls for comprehensive financial sector Digital resilience, that is, the ability to handle IT disruptions and cyberattacks. An ISMS provides:

  • Clear processes for handling security incidents.
  • Documented monitoring and reporting.
  • Proof-of-compliance through a structured system.


Note: An external consultancy can develop interfaces between the ISMS and the legal requirements in order to avoid unnecessary duplication of work.

Employees play a Key function in information security: Even the best technical measures are ineffective if employees e.g. fall for phishing e-mails or pass on passwords. Therefore, Regular training and awareness campaigns Essential.

Objectives of training:

  1. Information security fundamentals mediating.
  2. Behaviour in concrete situations (e.g.) B. Detecting social engineering attacks, dealing with suspicions.
  3. Corporate culture in which safety is a matter of course.


Note: External consultants can develop and implement customized training programs tailored to the specific industry and risk situation.

Internal audits should take place regularly (at least annually) in order to identify weaknesses at an early stage and exploit potential for improvement.

External audits As part of the certification process, it is typically carried out in a 3-year cycle:

  1. Certification audit (Initial audit)
  2. Annual surveillance audits (surveillance audits)
  3. Re-certification audit after three years


Note: When companies make significant changes to their ISMS (e.g. new scope, mergers, major technical changes, it may be useful to have additional audits or gap analyses carried out by an external partner.

Minor nonconformities (minor deviations): These deviations must be resolved within an agreed period (often 90 days). The certificate is usually not endangered, provided corrective measures are implemented in time.

Major Nonconformities (serious deviations)If there are significant gaps in the ISMS or violations of basic standards, the certificate cannot be issued or maintained until the deviations are permanently corrected.

Note: External consultants can be at the Corrective action planning and the Implementation help to ensure that the nonconformities are closed in a timely and effective manner.

The standard specifies some Mandatory documents before, including:

  1. ISMS Guideline (policy)
  2. Documented procedures and guidelines (e.g. B. Risk assessment process, contingency plan
  3. Risk assessment and Risk management plan
  4. Statement of Applicability (SoA)
  5. Documented results (e.g.) B. Audit reports, management assessments, corrective actions


In addition, the standard requires that Records to be able to demonstrate the implementation and effectiveness of the ISMS (e.g. B. Protocols of security incidents, training participation.


Note: An external consultancy can provide templates that comply with the standard requirements and can be used during the creation or Adaptation of these documents.

An ISMS covers numerous technical controls, for example:

  • Firewalls, Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS)
  • Encryption Data (both storage and transmission)
  • Hardening of systems (Hardening) and regular Patch management
  • Identity and access management (IAM) with strong authentication procedures
  • Network segmentation for reducing the spread of damage
  • SIEM systems (Security Information and Event Management) for real-time monitoring


Note: External consultants can provide manufacturer-neutral recommendations on which solutions best fit the respective IT environment.

In addition to technology, organizational aspects are also essential:

  • Role and authorization conceptsClearly defines who has which rights and why.
  • Contract and supplier management: Security requirements in contracts, verification of service providers.
  • Regulations and guidelines (e.g.) B. Password Policy, Bring-Your-Own-Device Policy.
  • Incident response processes: What happens in a security incident, who is informed?
  • Emergency Planning and Business Continuity: Ensuring business operations in the event of outages.


Note: Organizational measures are often underestimated, although they form the basis for an effective safety culture. External consultants can help develop workable guidelines.

An ISMS can – and should – Scaled will become. Small and medium-sized enterprises (SMEs) can also benefit from an ISMS:

  • Protection of sensitive data (e.g.) B. Customer data, intellectual property
  • Competitive advantage: Especially in industries where customers or partners pay attention to security.
  • Risk awarenessStructured approach helps to prevent cyberattacks or data loss.


The requirements can be set in a Appropriate size so that there is no excessive bureaucratic effort.

Note: External ISMS consultants can help SMEs to implement the relevant measures “slim” and optimize costs.

Authorities value an ISO/IEC 27001 certified ISMS as proof of compliance with the "state of the art" and for lived compliance.

Customers feel confident that their data is protected, which strengthens customer trust.

Partners see that information security is a core enterprise value and can work together smoothly (e.g.) in the data exchange.

In addition, an ISMS can contribute to Fines and liability risks avoid, since it has been demonstrated that adequate security measures exist.

The Secret Protection Act (GeschGehG) requires the demonstration of adequate safeguards against trade and commercial secrets. An ISMS according to ISO/IEC 27001 offers a solid basis here:

  • Systematic classification: The ISMS already defines processes for classifying information and granting access rights.
  • Documentation: The ISMS documents the implementation of measures, which serves as evidence in legal disputes or in an emergency.
  • Continuous improvement: As part of the ISMS, measures are continuously monitored and optimized.


Note: External consultants can specifically check whether all requirements of the GeschGehG are covered and recommend specific additions.

Experience and best practicesExternal specialists have often implemented projects in many industries and are familiar with typical pitfalls.

Independent viewConsultants bring objectivity and recognize optimization potential that internal teams might overlook.

Time and cost efficiency: With established methods and processes, the establishment or improvement of an ISMS can take place faster.

Transfer of know-how: The internal team learns from experts and can apply the knowledge independently later.

In addition, external consultants are usually Always up to date regarding legal changes (NIS2, DORA, IT security law, etc.) and technical trends.

Sustainable competence building: The internal team benefits from the transfer of knowledge and can independently cope with future challenges.

Proactive risk managementThanks to regular updates on standards and best practices, companies remain at the current level of security.

Reduced risk of errorThe expertise of experienced consultants minimizes the risk of costly wrong decisions or compliance violations.

Holistic implementationExternal consultants consider not only technology, but also processes, organization and culture – for a comprehensive security concept.

In this way, the ISMS develops into a Strategic instrumentwhich not only creates security, but also Value added strengthening a company and enabling new business opportunities.

Your experts in IT security issues

Whether CISO, CIO, IT manager, IT manager or responsible for IT security – our experienced IT security experts have extensive practical experience and develop tailor-made solutions that are perfectly adapted to the needs of your company.

  • Many years of experience in management systems with focus on ISO 9001, 14001, 27001, 27701, 22301 & GDPR
  • Advising for DAX & international companies, banks, authorities and the military on information security, data protection, business continuity, quality and environmental management
  • Implementation, auditing, certification & optimization of management systems
  • ISO 9001 Lead Auditor, ISO 14001 Lead Auditor
  • EMAS environmental verifier
  • ISO/IEC 27001 Lead Auditor, ISO/IEC 27001 Lead Implementer, ISO 22301 Lead Auditor
  • Data protection officer (TÜV), data protection auditor (TÜV).
  • Digital Transformation Manager (TÜV), Business Continuity Manager (TÜV).
  • PMP, PRINCE2, MSP, ITIL Expert, CISSP, CISSP-ISSAP, CISM
  • Development of training materials on IT security, management systems & compliance
  • Conference Speaker

Initial consultation free of charge

Do you want to introduce an information security management system? We operate in Germany, Austria and Switzerland and support you.