ISMS add-on

ISMS add-on The add-on adds to Pro or Enterprise and is licensed separately.

The ISMS add-on leads organisations without security staff of their own through an information security management system after BSI Standards 200-1 to 200-3. With the add-on, the IT-Grundschutz becomes part of an ISMS group in the navigation that leads through all of its pages.

Support, not an audit

The add-on structures and documents. Assessments, approvals and reports remain decisions of your organisation.

Parts of the ISMS

Area	Contents
Policy and responsibilities	the information security policy from a template, in versions, approved by the management with evidence; security officer, deputy, management and data protection named
Risk analysis	after BSI Standard 200-3 with a risk matrix (frequency times impact), elementary and own threats, grades before and after the treatment; risk acceptance only with the management’s approval
Implementation plan (A.6)	from the gaps of both Grundschutz variants and the measures of the risk analysis, with priority, costs, effort and CSV export
Evidence	an overview of all evidence with expiry, versions and review date, yearly by default
Guidelines	such as IT use, passwords, backup, mobile work, reporting incidents, e-mail and phishing, clean desk; from templates, approved by the management, reviewed every 12 to 36 months, acknowledgement per version
Suppliers and processing register	criticality from three plain questions, a questionnaire after module OPS.2.3 and NIS2, processing agreements after Art. 28 GDPR
Security incidents	with affected assets and reporting deadlines from when the incident became known: under NIS2 an early warning within 24 hours, a notification within 72 hours and a final report a month later; under the GDPR the authority within 72 hours
Internal audits	programme, checklists from eight templates or own questions, findings with corrective actions
Key figures and management review	figures from every area; the management’s review with a snapshot of the figures and a guide after ISO/IEC 27001, 9.3
Reference documents A.0 to A.6	policies, structure analysis, protection requirements, modelling, Grundschutz check, risk analysis, implementation plan; as a print view, as PDF through the browser and as Markdown

Working with the IT-Grundschutz

State, responsible person and date of a requirement stay in the Grundschutz check and are only shown in the implementation plan. The reference documents are put together from the ISMS and the Grundschutz whenever they are opened, in both variants.

Start on the ISMS start page with its guided process. You can try the add-on in the trial.