ISMS Consulting
We build and operate information security management systems that work day to day: lean, risk-oriented along your real threat landscape and suited to the size and maturity of your organization. Whether ISO 27001, BSI IT-Grundschutz, CISIS12 or deliberately without certification: you get an ISMS that is lived rather than administered.
What an ISMS does and when you need one
An information security management system (ISMS) is the framework an organization uses to manage its information security systematically: responsibilities are assigned, risks are assessed regularly, measures are selected on a justified basis and their effectiveness is checked. Individual actions become a cycle that makes security plannable and puts management decisions on a solid footing.
The trigger is rarely academic: major customers ask about security management in supplier assessments, NIS2 requires affected organizations to have risk management and evidence, and cyber insurers tie their terms to traceable structures. And even without external pressure: anyone who wants to steer their security needs structure. An ISMS is not the same as a certificate. The system creates the security, the certificate proves it to the outside world. Whether you need that proof is something we clarify honestly in the initial consultation, even if the answer is: not necessary.
Which standard fits your organization
There are several established frameworks for an ISMS, and they differ significantly in target group, effort and the proof they provide. The choice is an economic decision: it determines how much structure you build and which proof you hold in your hands at the end. The most important ones at a glance:
| Standard | Suited for | Proof |
|---|---|---|
| ISO/IEC 27001 | Internationally recognized, most frequently required by major customers and in tenders; independent of industry. | Certificate from an accredited body, valid for three years with annual surveillance audits. |
| BSI IT-Grundschutz | Public authorities, public administration and companies connected to the public sector; very detailed catalogs of measures. | ISO 27001 certificate based on IT-Grundschutz, audited by the BSI. |
| CISIS12 | Small and medium-sized organizations that want a structured start; twelve clearly defined steps. | Certificate that can later be expanded to ISO 27001. |
| VDA ISA / TISAX® | Automotive suppliers and service providers whose customers require a TISAX® label. | TISAX® label after an assessment by an ENX-approved audit provider. |
And if nobody requires proof? Then we still build the ISMS along the ISO structure, just without the certification overhead: the same structure, the same risk orientation, no audit burden. If an obligation to provide proof comes later, for example through a new major customer, the path to the certificate is short because nothing has to be rebuilt. We advise independently of any standard and earn nothing from any framework: we recommend what fits your requirements.
Building an ISMS: from the starting point to a lived system
We start with a baseline assessment: which structures, policies and measures are already in place, what is missing, what is oversized? This results in a prioritized roadmap that we work through together:
- Scope and context: a cleanly defined scope that determines the effort and significance of the system
- Risk methodology and risk assessment: prioritized in a threat-informed way along the techniques of your real adversaries
- Policy and guidelines: short enough to be read, clear enough to hold
- Selection and implementation of measures: justified by risk treatment, technically supported by the CIS Controls where they fit
- Metrics and management review: so that management can steer instead of hoping
- Internal audit: conducted independently, with solid findings instead of a courtesy report
Our work does not end with the build, because an ISMS lives through operation: updating risk assessments, following up on measures, analyzing incidents, preparing the management review. If you wish, we take this on permanently as an external information security officer or virtual CISO, with an agreed monthly budget. And if certification is the goal, we guide you all the way through the audit: our page on ISO 27001 consulting shows what that looks like in practice.
Lived, not administered: an ISMS without mountains of paper
Most ISMS do not fail because of the standard but because of everyday life: documents nobody reads, risk lists that are copied once a year, measures that are effective on paper and nowhere else. We counter this with two principles. First, risk orientation that deserves the name: the risk assessment starts with the techniques that adversaries actually use against organizations like yours (Threat-Informed Defense). This gives every measure a traceable justification, toward management as well as toward any auditor.
Second, documentation with a sense of proportion: controlled, current, easy-to-find content in the tools you already use, such as Confluence or SharePoint. An expensive specialized solution is not an audit criterion, and a graveyard of Word files even less so. The result is a system that supports your organization instead of keeping it busy: security comes first, and the evidence follows as a by-product.
Talk to us now, not to your customers later.
Frequently asked questions about ISMS consulting
What is an ISMS?
An information security management system (ISMS) is the entirety of rules, responsibilities and processes an organization uses to manage its information security: assessing risks, selecting and implementing measures, checking their effectiveness and improving continually. The best-known framework for this is ISO/IEC 27001; alongside it there are BSI IT-Grundschutz, CISIS12 and industry-specific catalogs such as VDA ISA.
Do we need a certified ISMS, or is one without a certificate enough?
You only need the certificate if someone requires proof: customers, tenders or regulators. The security effect comes from the system itself, not from the certificate. Without an obligation to provide proof, we build the ISMS along the ISO structure without the certification effort; if the obligation comes later, the path to the certificate is short. We answer this question with an open mind in the initial consultation.
Which standard fits: ISO 27001, BSI IT-Grundschutz or CISIS12?
That depends on who wants to see the proof and how your organization is set up. ISO 27001 is the most frequently required standard internationally. IT-Grundschutz is mainly suited to public authorities and organizations close to them. CISIS12 offers smaller organizations a structured start in twelve steps that can later be expanded to ISO 27001. For automotive suppliers, the path usually leads via VDA ISA to the TISAX® label. We advise independently of any standard and recommend what fits your requirements.
How long does it take to build an ISMS?
That depends on the size, complexity and maturity of your organization: anyone already working in a structured way will be much faster than an organization starting from zero. The chosen standard and the definition of the scope also have a direct effect on the effort. After the baseline assessment, we can estimate the path for your situation concretely; a blanket number would not be serious.
What does ISMS consulting cost?
The cost depends on the scope of support: baseline assessment, building individual building blocks or the complete system including operation. The scope of the ISMS is the biggest lever, because it determines how many processes, locations and systems the ISMS has to cover. If certification is added, the audit costs of the certification body come on top. After the initial consultation, you receive a proposal with clearly defined packages instead of an open-ended day-rate bill.
Who runs the ISMS after it has been built?
An ISMS needs someone to look after it: updating risk assessments, following up on measures, organizing training, preparing the management review. This role can be filled internally; we then build the system so it can be handed over and enable your employees. Alternatively, we take over operation permanently as an external information security officer or virtual CISO, with an agreed monthly budget and availability during security incidents.
Does NIS2 require an ISMS?
NIS2 does not require a certificate and does not name a standard. But the law requires risk management, concrete security measures and evidence toward the supervisory authority, and the management bodies must oversee implementation. This is exactly what an ISMS provides: it is the structured framework in which these obligations are fulfilled and documented traceably. Whether you fall under NIS2 and what follows from that is something we clarify in the applicability assessment on our NIS2 page.
Daniel Thomas Heessel is a certified ISO 27001 Senior Lead Auditor, CISSP and CISM and was named CISO of the Year 2026. Having built management systems as a consultant, operated them as the person responsible and audited them as an auditor, Daniel knows what makes an ISMS viable in everyday life and what only produces paper.
Reviewed in August 2026. The structure follows ISO/IEC 27001:2022 and the implementation guide of the ISACA Germany Chapter.