Build the management system
We help build and maintain practical management systems such as ISO/IEC 27001 and ISO 9001 — designed around how your organization already works.
From Noise to Choice
Information security that works inside your organization.
We build management systems such as ISO/IEC 27001 together with your team, implement what comes out of them, and help you navigate cybersecurity and AI compliance — using what you already have, in a way your people understand.
How we work with you
- UnderstandWhat you have and what is required
- BuildAn ISMS that fits your organization
- ImplementTogether with your team
- OperateAlso after the certificate
- ImproveWith growing internal capability
From requirement to implementation
Four promises that shape how we work — from building the ISMS to a team that can carry it on its own.
Implement what comes out of it
When the ISMS identifies a risk, gap, control or improvement, we help determine the right next step and implement it — process, people or technology.
Work with your team
We take part in the work instead of handing over a task list: workshops, working sessions, coordination and follow-up alongside your people.
Build internal capability
We explain, train and transfer knowledge while doing the work — so your team can increasingly run and improve the ISMS itself.
Our focus
Information security management systems based on ISO/IEC 27001
Whether you need to build a new ISMS or keep an existing one alive: this is our core expertise. Everything else builds on it.
ISMS & ISO 27001
Build a working ISMS and prepare for ISO/IEC 27001 certification — together with your team and on top of the tools you already use.
ISMS Maintenance
Ongoing support for an existing ISMS: risks, controls, evidence, audits and reviews that keep happening — not just before the audit.
More services that follow from the ISMS
How we work
The same logic applies whether we build a new ISMS, take over an existing one or implement a single measure.
-
Understand
Your organization, people, technology, existing processes and management systems.
-
Integrate
Use what already works. Avoid unnecessary replacement and duplicate processes.
-
Identify
Requirements, risks, gaps, findings and improvement opportunities.
-
Prioritize
Decide what actually matters and what should be addressed first.
-
Implement together
Work alongside your teams on practical organizational and technical measures.
-
Enable
Explain the system, train where useful and transfer knowledge while doing the work.
-
Operate
Help coordinate recurring ISMS activities where ongoing support is wanted.
-
Improve
Measure effectiveness, learn from incidents and findings, keep improving.
-
Extend
Where new capabilities are needed: existing technology, process changes, open source, European vendors, specialists and funding.
-
Automate
Where useful, simplify or automate repetitive management-system work with appropriate technology and AI.
We don’t just tell you what needs to be done. We help you do it.
The classic consulting model
- Consultant analyses the company
- Creates a report
- Produces a task list
- Customer does everything
- Consultant returns later
How we work
- FeldmannCyber + your team
- Understand & prioritize
- Plan together
- Implement together
- Operate together
- Transfer knowledge
- Improve
FeldmannCyber App
Software that supports the work around the ISMS
The FeldmannCyber App is available today. We set up access after a short conversation. Every capability is clearly labelled with its status.
Process & project management
Plan processes, tasks, responsibilities and deadlines — with substantial Gantt and timeline functionality for implementation work.
ISMS & compliance projects
Structure ISMS and compliance projects: work packages, activities, milestones, sign-offs and progress tracking.
Messaging
Communicate around ISMS and project activities in one place — including images and videos where useful.
Vendor Intelligence
Explore 350+ curated cybersecurity vendors with a strong European and open-source focus, using filters instead of endless web searches.
Funding Intelligence
Find funding programs for security, digitalization and AI in Germany and the EU — filtered by region, topic and type.
ISMS AI Assistant
A private, self-hosted AI assistant that helps with ISMS work — and integrates with your existing environment.
Technology independence
European where possible. Open where practical. Integrated with what already works.
European organizations should have credible technology choices and not depend unnecessarily on a small number of providers. That is why we seriously consider European vendors, open source and self-hosting for every measure — without claiming that European automatically means more secure.
-
European vendors
350+ cybersecurity vendors in our database, with a focus on the EU/EEA.
-
Open source
Open tools where they fit — including a realistic plan to operate them.
-
Self-hosting
Controlled environments for sensitive data and private AI.
-
Data sovereignty
Knowing where data lives, who can access it and what you depend on.
What should an incident response plan contain?
What an incident response plan must contain: roles, escalation, communication, NIS2 and CRA reporting deadlines, evidence and lessons learned.
What happens after ISO 27001 certification? ISMS maintenance explained
Certification is not the finish line. What ISMS maintenance involves, which activities recur every year, and how to avoid the pre-audit panic.
Can an ISO 27001 ISMS use your existing tools?
Can an ISO 27001 ISMS use your existing tools? Yes — how wikis, document management, ticketing and project tools can carry large parts of it.
How do you implement ISO 27001? A realistic step-by-step guide
How to implement ISO 27001 step by step: scope, gap analysis, risk assessment, SoA, measures, internal audit and certification — realistically explained.
ISO 42001 and the EU AI Act: what they require and how they relate to ISO 27001
What AI governance means, what ISO/IEC 42001 is, what the EU AI Act requires after the 2026 Digital Omnibus amendment, and how both connect to an existing ISMS.
Can ISO 9001 and ISO 27001 be combined? Integrated management systems explained
What ISO 9001 and ISO/IEC 27001 have in common, which processes an integrated management system (IMS) can share, and what remains specific to each standard.
NIS2, Cyber Resilience Act and EU AI Act: an overview for companies
NIS2, the Cyber Resilience Act and the EU AI Act explained: who is affected, which 2026 deadlines apply and how one ISMS covers shared requirements.
What is an ISMS? Information security management explained simply
What an information security management system (ISMS) is, what it consists of, how it relates to ISO/IEC 27001 — and why it is more than a set of documents.
Not sure where to start?
Tell us what you’re trying to solve. We listen, ask questions and suggest a sensible first step.