ISMS & ISO 27001
Build a working ISMS and prepare for ISO/IEC 27001 certification — together with your team and on top of the tools you already use.
Core expertise
Services
From management system to implemented measure
The information security management system is at the centre. Whatever it uncovers — risks, gaps, improvements — we implement together with your team. The services below are examples, not a closed catalogue.
Management systems
Building, operating and integrating management systems — our core expertise.
ISMS Maintenance
Ongoing support for an existing ISMS: risks, controls, evidence, audits and reviews that keep happening — not just before the audit.
Core expertise
ISO 9001 & Quality Management
Introduce or maintain a quality management system according to ISO 9001 — practical, process-oriented and ready to integrate with other standards.
Integrated Management Systems
Combine quality, information security and AI governance in one integrated management system with shared processes.
Cybersecurity & compliance
Understanding regulatory requirements and turning them into effective measures for people, processes and technology.
Cybersecurity Compliance
Understand which cybersecurity regulations apply, identify the gaps and implement practical technical and organizational measures.
Security Awareness & Training
Awareness training connected to your ISMS, policies and systems — so employees understand not only what to do, but why.
Incident Response Planning
Develop a clear incident response plan with your team: roles, escalation, communication, reporting and lessons learned.
Cybersecurity Technology Advisory
When a gap is identified, we help you find the most appropriate measure: existing technology, process, open source or a suitable vendor.
AI
Governing and securing the use of AI — embedded in existing governance.
AI Governance & Compliance
Get an overview of AI use, set clear rules, assess risks and prepare for the EU AI Act and ISO/IEC 42001 — without creating another silo.
Secure & Private AI
Plan and secure private or self-hosted AI: local models, controlled knowledge access and data sovereignty — governed like any other critical system.
Advisory & intelligence
When measures need technology or financing: market knowledge instead of guesswork.
Cybersecurity Vendor Advisory
Requirement-driven vendor selection with curated intelligence on 350+ cybersecurity vendors and a strong European and open-source focus.
Funding Advisory
Identify relevant funding programs for cybersecurity, digitalization and AI projects in Germany, the federal states and the EU.
Integrated ISMS support
An ISMS should create action — not just documentation
An ISMS continuously produces work: requirements, risks, findings, objectives. Our support follows what your management system identifies — from the requirement to a measure that is implemented, evidenced and reviewed.
- Requirement, risk or finding
- Action required
- Organizational or technical measure
- Implementation
- Evidence
- Effectiveness review
- Improvement
Example: a risk assessment identifies weak authentication
Many consultants would write “implement stronger authentication” into a report and leave. This is what it can look like with us instead:
- Requirement understoodWhich systems, users and access paths are affected — and what does “strong enough” mean for this risk?
- Existing environment reviewedYour identity provider, VPN, cloud services and applications — often the capability is already licensed.
- Options evaluatedSettings in existing tools, organizational rules, open-source or European alternatives if something is missing.
- Decision by youYou choose the solution based on a clear comparison of effort, cost and risk reduction.
- Implementation supportedRollout plan, coordination with IT and service providers, exceptions handled.
- Responsibilities & peopleOwners defined, employees informed or trained where necessary.
- Evidence & reviewEvidence collected, effectiveness checked, risk and control status updated in the ISMS.
Examples of what we can help with
This is not a closed catalogue. If an activity, risk, control or improvement comes out of your ISMS, there is a good chance we can help you address it.
Structure
- Risk and asset management
- Controls and Statement of Applicability
- Policies, procedures and process design
- Information classification
- Access-control processes
- Evidence structures
Steering
- Security objectives and KPIs
- KPI monitoring
- Internal audit preparation
- Management review preparation
- Corrective actions
- Documentation maintenance
People
- Responsibilities and competence
- Awareness and employee training
- Incident response planning
- Workshops and working sessions
- Supplier security and assessments
Beyond the ISMS
- Security technology research
- Vendor, open-source and European alternatives
- Funding opportunity research
- AI governance and secure AI
- Other measures that arise from the ISMS
We do not claim to provide every specialist service ourselves — for example 24/7 SOC, MDR, penetration testing, digital forensics, emergency incident response or legal advice. Where these are needed, we help you define the requirement, find suitable specialists or solutions and integrate the result into your ISMS.
How deep we get involved
From advice to working alongside you
Every engagement is different. Most combine these three kinds of support — and shift over time as your team takes over.
Advise
We explain what is required, what the problem is, which options exist and what we recommend.
Implement together
We work with your team to design processes, create structures, prepare documentation, run workshops and close gaps.
Operate & improve together
We help coordinate recurring activities, follow up on actions, review risks, prepare audits and reviews — and keep the momentum.
Part of the team — not a transfer of responsibility
Working alongside you does not mean we take over your management responsibilities. Risk ownership, process ownership, decisions and legal responsibilities stay with your organization unless something specific is agreed. Our role: help you do the work — and do it well.
The big picture
From requirement to a stronger internal team
- Understand
- Build the ISMS
- Identify risks & gaps
- Prioritize
People
- Awareness
- Training
- Adoption
- Knowledge
Process
- Policies
- Procedures
- Incident response planning
- Controls
Technology
- Existing tools
- Open source
- European vendors
- Other solutions
- Implement together
- Operate together
- Measure effectiveness
- Improve
- Transfer knowledge
- Stronger internal team
Your topic isn’t listed?
If it comes out of your ISMS, there is a good chance we can help — or we will tell you honestly who is a better fit.