The questions we are actually asked.

Yes. There is a 14-day free trial with full access, requested via the contact form. No payment details are needed.

Everything you set up during the free trial carries over seamlessly into the paid plan. If you do not choose a plan, the trial ends automatically.

The technical part takes an afternoon: create the tenant, invite users, activate a framework, assign owners. What takes time is filling it – working out which evidence already exists in your organisation and which still has to be created.

Realistically, for a first ISO 27001 certification: three to six months to audit readiness if someone in-house genuinely drives it. If it is done on the side, expect nine to twelve.

With the scope, not the measures. Decide which sites, systems and processes are included and which are explicitly excluded. Every hour you invest here saves you three later – a scope drawn too wide is the most common reason projects drag on.

After that: assign owners for each topic area, then take stock. Only then the measures.

Fewer people than you think. One owner per topic area is enough; everyone else is assigned tasks and does not need permanent access. The Basic edition includes five internal users, Professional ten, Enterprise by agreement.

No. Sign-in via SAML or OIDC is not currently available; access is through separate accounts in Sightadel.

If single sign-on is a requirement for you, please tell us before the free trial – then we can assess whether and when it could work for you, rather than surprising you with it later.

Yes, and that is the usual case. You import existing Excel spreadsheets and Word documents directly; policies, procedures and evidence are mapped to the relevant requirements.

What almost always comes to light: the spreadsheet records states that have not been true for months. That is not an argument against moving, it is the reason for it.

Per framework. You subscribe to ISO 27001, NIS2 or DORA individually, each in one of three editions. The editions differ in capacity and response time – internal users, evidence storage, monitored assets, vendors, support – not in the content of the framework.

In concrete terms: requirements, evidence structure and audit export are the same in Basic as in Enterprise.

If your licence includes ISO 27001 or ISO 9001, every other framework is permanently 5% below list price. ISO 27001 and ISO 9001 themselves are excluded. On top of that there are discounts for paying in advance. You will find the exact terms and a calculator on our pricing page.

The real gain with the second framework, however, is not the discount but the fact that much of the evidence is already in place. More on this in the section on reuse.

Six, and they make an explicit distinction between internal and external:

Admin (owner) – manages the tenant, users and subscriptions.

Consultant, internal – works on content across all frameworks.

Contributor, internal – works on the items assigned to them.

Viewer – reads along without making changes.

Consultant, external – for consultants you bring in.

Auditor – always external; reads, comments, creates and edits after approval, never deletes.

The separation between internal and external consultants is not a detail: in the audit, it must be clear who belongs to your organisation and who does not.

Yes. Basic includes one custom framework, Professional three, Enterprise as many as you like. This is the route for group requirements, customer requirements from contracts or industry standards for which no ready-made module exists.

Yes. There you bring together what customers and prospects ask for anyway – certificates, attestations, hosting details, sub-processors – and point them to it instead of sending the same attachment every time.

The benefit shows with the third customer questionnaire: whatever is in the Trust Center no longer has to be researched for the questionnaire.

Not completely, and that is deliberate. For every requirement there are templates tailored to your industry. The AI helps with wording and suggests text; you decide.

What makes your company what it is – objectives, risks, responsibilities – you describe yourself. Otherwise the standard does not fulfil its purpose, and it shows in the audit.

You ask directly at the control. For important questions and tricky cases, real consultants with audit experience answer – not a ticket system.

If you bring in your own consultancy, it gets its own external role in the account.

The focus is on evidence management itself, not on a long list of ready-made connectors. If a particular integration is decisive for you, raise it with us before the free trial.

And a point that vendor comparisons tend to leave out: automatically collected evidence does not replace a decision. A tool can show that encryption is active – whether it is adequate is still for you to decide, and that is exactly what the auditor asks.

Yes, after agreement. We implement very specific requirements that the standard does not cover as customisation. We clarify scope and costs with you beforehand in an offer. More on the Customisation page.

German and English. The working materials in the resources section – checklists, evidence packs, guides – are also available in French, Spanish and Portuguese, both European and Brazilian.

From the dashboard: compliance progress per framework, open tasks with deadlines and expiring evidence. What helps is less the overall figure than the direction: what has expired since last month, and who is dealing with it.

Two things that are often confused. First, clauses 4 to 10: a management system covering context, leadership, planning, operation, performance evaluation and improvement. Second, Annex A: 93 controls in four themes – organisational, people, physical, technological.

Organisations rarely fail an audit on Annex A. They fail on clauses 9 and 10: internal audits, management review, corrective action. That is the part you cannot buy.

The Statement of Applicability (SoA) is the only document the standard explicitly names as mandatory and the one the auditor wants to see before all others. For each of the 93 controls it states: applicable or not, with a justification, and if applicable, a reference to the implementation.

Excluding a control is allowed. Excluding it without a justification is a nonconformity.

Yes, and it must be repeatable. The standard does not prescribe a method, but it does require that the same inputs lead to comparable results. Gut-feeling assessments by changing people do not meet that.

Incidentally, the order is the reverse of how most people start: first risks, then controls, then the Statement of Applicability. If you begin with Annex A, you end up justifying backwards.

No, and it may not be. ISO standards are protected by copyright and licensed individually – via Beuth, now DIN Media, in Germany or directly from ISO. Sightadel contains the structure, the controls, the evidence management and our own explanations, not the wording of the standard.

So you need at least one copy of the standard in-house. That applies to every platform, including those that do not mention it.

Fewer than template packs suggest. The standard explicitly requires a manageable number of documented information items – scope, policy, risk methodology, risk treatment plan, Statement of Applicability, evidence of competence, audit programme and results, management review, nonconformities and corrective action.

Anything beyond that is needed when, without it, you cannot show that a control is effective. A policy that nobody reads is not evidence, it is dead weight.

That is almost always decided by the customer, not by the standard. ISO 9001 is sector-neutral and is certified for service providers just as for manufacturers. The usual trigger is a tender or a framework agreement that lists the certificate as a prerequisite.

Yes, and that is the real reason to manage both in one tool. Both standards follow the same high-level structure: context, leadership, planning, support, operation, performance evaluation, improvement.

In practice this means one document control procedure, one internal audit programme, one management review, one corrective action procedure – not two of each. Many certification bodies offer a combined audit, which saves audit days.

No. ISO 9001:2015 does not require a process catalogue or a quality manual – both come from older editions and have proved stubbornly persistent. What is required is that you know your processes, control them and measure their effectiveness.

Where a description is missing and the result is still right, that is not a finding. Where it is missing and errors keep recurring as a result, it is.

The test has two stages. First, the sector: does your activity fall under the list of entity types? Second, size: from 50 employees or €10 million annual turnover you count as an important entity, from 250 employees or €50 million as an essential entity.

Regardless of size, the obligation applies to certain entities – for example operators of critical facilities and providers of certain digital services. Our NIS2 checklist contains a sheet that calculates the classification.

As a rule, no. The thresholds are 50 employees or €10 million turnover; a single-doctor or small group practice is below them. What is binding there is the IT security guideline under § 390 SGB V (German Social Code, Book V; formerly § 75b) – it applies to every practice, regardless of size, and among other things explicitly requires a firewall.

NIS2 can still reach you indirectly: if you are connected to a hospital, a laboratory or a medical care centre (MVZ) that is itself subject to the obligation, you receive requirements through its supply chain.

Three, and all of them run from the moment you become aware. Early warning within 24 hours, incident notification within 72 hours, final report within one month. If the incident is still ongoing at the end of the one-month period, you first submit a progress report.

The most common mistake is not the missed deadline but the unrecorded starting point. Note the date and time you became aware before you do anything else.

Management must implement the risk management measures, oversee their implementation and undergo training. It can delegate tasks, but the responsibility stays with management and carries personal liability.

In practice this means you need a management resolution with a date and signature, not an e-mail saying ‘looks fine’. Our NIS2 checklist has a separate printable sheet for this.

No. NIS2 is not a certifiable standard but an obligation with supervision. You demonstrate implementation to the competent authority, not to a certification body.

That is why evidence management matters even more here than with ISO: there is no certificate you can show – only your documentation. Anyone selling you a ‘NIS2 certificate’ is selling you a piece of paper with no legal effect.

To financial entities in the EU in the broad sense – banks, insurers, investment firms, payment service providers, crypto-asset service providers and others – and to critical ICT third-party service providers that supply them. The regulation has applied directly since 17 January 2025, without national transposition.

If you supply software or operations to financial entities, the requirements reach you through the contract, even if you are not a financial entity yourself.

Seven areas: ICT risk management, handling and reporting of ICT-related incidents, digital operational resilience testing, management of ICT third-party risk, the register of information, information sharing and oversight of critical third-party providers.

Our DORA checklist breaks this down into 50 requirements with article reference, expected evidence and status.

For a major ICT-related incident: initial notification no later than four hours after classification as major and in no case later than 24 hours after becoming aware. Intermediate report within 72 hours, final report within one month.

The difference from NIS2 lies in the starting point: DORA ties the first deadline to classification, NIS2 to awareness. If you are subject to both, keep the two cleanly separate in your incident process.

Only some firms. Threat-led penetration testing (TLPT) under the TIBER-EU framework is intended for certain financial entities designated by the supervisor, at least every three years, with every third test to be carried out by an external tester.

All others need a testing programme, but not TLPT: vulnerability assessments, network security assessments, source code reviews, penetration tests in the usual sense.

A complete record of all contractual arrangements on the use of ICT services, at individual entity and group level. It is submitted to the supervisor regularly; the usual reference date is 31 December of the previous year.

In our experience this is where projects stall: the required fields are not in any contract folder but have to be gathered from contracts, procurement and operations.

ISO 27001, ISO 9001, ISO 42001, NIS2, DORA, GDPR, EU AI Act, BSI C5, SOC 2, NIST CSF 2.0, § 390 SGB V for medical and dental practices and HACCP, plus custom frameworks.

No, and the differences are bigger than comparison tables suggest. ISO 27001 is a standard with a certificate from an accredited body. SOC 2 is an examination report by an independent auditor (certified public accountant) under US standards – not a certificate but a report that you pass on to customers.

Type I describes the suitability of the controls at a point in time, Type II their operating effectiveness over a period, usually three to twelve months. For European customers ISO 27001 usually counts, for US customers usually SOC 2.

The criteria catalogue of the German Federal Office for Information Security (BSI) for cloud services. It is not certified but attested: an independent auditor examines against ISAE 3000 and issues an attestation, either at a point in time or over a period.

It is needed almost exclusively by cloud providers supplying the public sector or regulated customers in Germany. If nobody asks you for it, you do not need it.

Partly, and the gap is the interesting half. ISO 27001 protects information regardless of whose data it is. The GDPR asks about legal basis, purpose limitation, data minimisation, data subject rights, records of processing activities and data protection impact assessments.

The technical and organisational measures under Article 32 overlap strongly with Annex A. Everything to do with lawfulness and the rights of data subjects has no counterpart in ISO 27001.

As an organising framework, not as a certification goal. The six functions – Govern, Identify, Protect, Detect, Respond, Recover – provide a language for presenting maturity to management and the supervisory board without having to read out ISO clauses.

It is also useful with US customers and insurers who ask for it. There is no certificate.

ISO 42001 is the management system standard for artificial intelligence, structured like ISO 27001 and certifiable. If you already run an ISMS, you can largely reuse leadership, the risk process, internal audits and management review.

It does not replace the obligations under the EU AI Act, but it helps you meet them in a structured way.

Anything from which a third party can see that something was actually done – with a date and an author. Minutes, a screenshot of a setting, an approval in the ticket system, a signed sheet, an extract from a log.

What is not evidence: a policy that prescribes something. It proves the intention, not the implementation. The most common finding in a first audit is exactly this confusion.

As current as the cycle you set yourself. If your policy provides for an annual review of access rights and the last one was 18 months ago, that is a nonconformity – not because the standard requires 12 months, but because you did.

Hence the uncomfortable recommendation: set cycles you can keep. Six-monthly sounds more thorough and becomes a source of findings in the second year.

The auditor must be able to assess effectiveness, not read every detail. For personal data or particularly sensitive content, redacted extracts, samples or on-screen review without a copy are common and accepted.

Insist that how this is handled is agreed before the audit, not in the audit room.

Less than you might think, provided you keep references rather than copies. Basic includes 1 GB, Professional 10 GB, Enterprise 100 GB. If you store every screenshot at full resolution, you will reach the limit sooner than someone who links to the ticket system.

That the same matter is asked about in several frameworks and you provide evidence for it exactly once. Access management appears in ISO 27001 Annex A, in NIS2 measure 9, in DORA under ICT risk management and in SOC 2 under the common criteria. That is the same question four times.

If you keep a separate folder for each framework, you maintain the same evidence several times – and after a year you have it in three different versions.

A piece of evidence is stored once and linked to every requirement it serves – across frameworks. A change applies to all linked requirements; if the evidence expires, it expires everywhere.

The difference from the spreadsheet approach shows not when you create it but a year later: there, the same evidence exists in three versions; here, in one.

It depends on the pair, and it can only be stated reliably with your data. Rough experience: ISO 27001 and NIS2 overlap strongly on the technical and organisational side; ISO 27001 and SOC 2 likewise; ISO 27001 and the GDPR only where Article 32 is concerned.

We deliberately do not give a percentage. Anyone who tells you two frameworks overlap by 80% has either not seen your scope or is counting requirements rather than effort.

Anything tied to a specific legal consequence or a specific procedure. The reporting deadlines under NIS2 and DORA are not identical. The management resolution under NIS2 does not replace a management review under ISO 27001. The DORA register of information has no counterpart in ISO 27001.

These leftovers are exactly why a simple mapping table is not enough.

The broadest first, if you have the choice. ISO 27001 carries over most into other frameworks, because both the management system and the control catalogue are needed. After that, the second framework is mostly an addition rather than a new build.

If a deadline is pressing, the deadline wins. NIS2 and DORA do not ask whether you did ISO first.

No. ISO standards are international standards, and a certificate to ISO 27001 or ISO 9001 is recognised worldwide, provided the issuing certification body is accredited and the accreditation body is a signatory to the multilateral arrangement of the International Accreditation Forum. In Germany that is DAkkS.

Only the legal acts are purely European: NIS2, DORA, the GDPR and the EU AI Act. Even these affect providers outside the EU as soon as they supply into the EU or process data of people in the EU. Conversely, SOC 2 and NIST are US in origin and are in demand worldwide.

In short: the standard is global, the obligation is regional.

No. Sightadel is software for preparation and maintenance – we do not certify and do not carry out certification audits. The certificate is issued by an accredited certification body after an audit.

You are free to choose the certification body. You can appoint your own or approach one from our independent partner network. No commission is paid for audits – neither to us nor to the partners.

This separation is not reticence but a principle: under ISO 17021, a certification body must be impartial and may not both advise and certify the same organisation. Anyone offering software, consultancy and certificate from a single source creates a conflict of interest that ultimately makes your certificate open to challenge.

Yes. There is a dedicated auditor role, always external – an internal user cannot be given it. The auditor sees the audit scope, adds comments and – once you approve – creates or edits entries, but can never delete anything. This saves sending evidence folders by e-mail and makes it traceable what the auditor has seen.

There is a separate role for consultants you bring in, so that in the audit it does not become blurred who audited and who contributed.

In two stages. Stage 1 is essentially a document review: scope, policy, risk methodology, Statement of Applicability, audit programme. Stage 2 checks effectiveness on site or remotely, with samples and interviews.

This is followed by two surveillance audits in the following years and recertification in the third year. The cycle runs for three years.

That depends on headcount and complexity and is derived by the certification body in accordance with ISO 27006. As an order of magnitude for a first ISO 27001 certification: about five days for up to ten employees, around eight to ten for 50, twelve to fourteen for a mid three-digit headcount.

Surveillance audits take roughly a third, recertification about two thirds of the initial audit time. Since the 2024 edition, the calculation has been more risk-based – the figures are a guide, not an entitlement.

Yes, as long as the person auditing does not audit their own area of work. Independence here means objectivity, not being external. In small organisations, departments audit each other; where that is not possible, an external internal auditor is the usual route.

The work that makes the difference. A certificate is a snapshot valid for three years, with two surveillance audits in between. Between audits, cycles continue: access reviews, supplier assessments, training, restore tests, management review.

The classic mistake is to take a break after the initial audit. It shows in the first surveillance audit, because evidence is missing for eleven months.

In three ways: as a notice on the dashboard, in the newsletter and in the news section on sightadel.com. The dashboard notice is the most targeted – it appears only for the frameworks you subscribe to, not for all the others.

Each notice states what has changed, what it means for your controls and by when something needs to be done.

No. New editions of the frameworks covered are available within your current subscription at no extra charge. For a transition such as ISO 27001:2013 to 2022, you get the new structure along with the mapping of your existing evidence.

The transition itself is still work – but it is not your job to pay for it again.

The International Accreditation Forum sets this for each standard; three years from publication is usual. After that, certificates to the old edition lose their validity, regardless of when your own cycle ends.

In practice this means the transition belongs in a regular surveillance or recertification audit, not in a special audit shortly before the deadline.

In Germany. Development, operations and support are also based here. No detour via data centres elsewhere, no access under foreign law.

For some of our customers, that is the reason to talk to us in the first place – and for everyone else, at least one question fewer in the vendor questionnaire.

Yes. Sightadel processes personal data on your behalf – user accounts, responsibilities, occasionally content in evidence. The data processing agreement (DPA) under Article 28 GDPR forms part of the contract, including the list of sub-processors.

Yes. Evidence, controls and status can be exported – that is a prerequisite for an auditor to work with them, and your safeguard against vendor lock-in.

Ask every vendor this, by the way, including us – and have them show you rather than just promise.

Keep a current export to hand before every audit. That is not distrust of us, but the same precaution you require of yourself in your recovery plan.

neonotu GmbH, which develops and operates Sightadel, is certified to ISO 9001 and ISO 27001. We process data in accordance with the GDPR and meet the DORA requirements for ICT third-party service providers.

We run our own management system in Sightadel – that is the most honest test such a tool can pass.

Licensing is per framework and edition (Basic, Professional, Enterprise) at a fixed monthly price. You will find all prices and a calculator on our pricing page.

There are discounts for multiple frameworks and for paying in advance. The terms and the edition comparison are also on our pricing page.

Contracts run for at least one year. You can pay monthly or annually: there are discounts for paying in advance; you will find the terms on our pricing page.

No. The certification body invoices you separately and directly, and it has to, because it must be independent. We receive no commission for it. As an order of magnitude in Germany: a first ISO 27001 certification costs roughly €9,000 to €13,000 for up to 50 employees, €15,000 to €22,000 for up to 250 (costs of the certification body, not of Sightadel). Surveillance audits are considerably cheaper.

These ranges are market observations, not a quote – obtain two or three quotes; the differences are considerable.

You export your evidence and your current status. What you take with you is your work.

We would rather you leave with your data than stay because you are worried about it.