How long does setup take?

The technical part takes an afternoon: create the tenant, invite users, activate the framework, assign owners. What costs time is filling it — which evidence already exists and which still has to be produced. Realistic for a first ISO 27001 certification: three to six months to audit readiness if someone genuinely owns it internally. Done on the side, it takes nine to twelve.

Where do I start on day one?

With the scope, not with the controls. Define which sites, systems and processes are in and which are explicitly out. Every hour spent here saves three later — an overly broad scope is the most common reason projects drag on. Then assign owners per theme, then take stock. Controls come after that.

Fewer people than you think. One owner per theme is enough; everyone else receives assigned tasks and needs no standing access. Basic includes five internal users, Professional ten, Enterprise by agreement.

Is there single sign-on through our identity provider?

No. Sign-in via SAML or OIDC is not available today; access runs through accounts in Sightadel itself. If single sign-on is a precondition for you, tell us before the trial — then we can say whether and when it is realistic, rather than surprising you with it later.

What does the second framework cost?

A permanent 5 % less, provided the first framework you licensed is ISO 27001 or ISO 9001. Term discounts come on top: 5 % for one year, 8 % for two years paid up front. The real gain with a second framework is not the discount but the fact that much of the evidence is already in place. See the section on reuse.

Six, and they deliberately distinguish internal from external: Admin (owner) — manages the tenant, users and subscriptions. Consultant, internal — works across all frameworks. Contributor, internal — works on assigned items. Viewer — read-only. Consultant, external — for advisors you bring in. Auditor — always external, read-only. Separating internal from external consultants is not a detail: an audit has to show who belongs to your organisation and who does not.

Can we model our own framework?

Yes. Basic includes one custom framework, Professional three, Enterprise any number. This is the route for group policies, contractual customer requirements or industry standards without a ready-made module.

Is there a trust center for our customers?

Yes. You assemble there what customers and prospects ask for anyway — certificates, attestations, hosting details, sub-processors — and point them to it instead of sending the same attachment every time. The benefit shows up at the third customer questionnaire: what is in the trust center no longer has to be researched for the form.

What is the Statement of Applicability and why does it matter so much?

The Statement of Applicability is the one document the standard names explicitly as mandatory, and the one an auditor wants to see before anything else. For each of the 93 controls it records: applicable or not, with justification, and where applicable a reference to how it is implemented. Excluding a control is allowed. Excluding it without justification is a nonconformity.

Do we need a formal risk assessment?

Yes, and it has to be repeatable. The standard prescribes no method but requires that the same inputs produce comparable results. Gut-feel scoring by changing people does not meet that. The order is the reverse of how most people start: risks first, then controls, then the Statement of Applicability. Starting from Annex A means justifying backwards afterwards.

Is the standard's text included in Sightadel?

No, and it must not be. ISO standards are protected by copyright and licensed individually — through DIN Media in Germany or directly from ISO. Sightadel contains the structure, the checkpoints, the evidence trail and our own explanations, not the wording of the standard. So you need at least one copy of the standard in house. That is true of every platform, including the ones that do not mention it.

How many documents do we need for ISO 27001?

Fewer than template bundles suggest. The standard names a manageable set of documented information — scope, policy, risk methodology, risk treatment plan, Statement of Applicability, competence records, audit programme and results, management review, nonconformities and corrective actions. Everything else is needed only where you cannot otherwise show that a control works. A policy nobody reads is not evidence, it is ballast.

Can ISO 9001 and ISO 27001 run together?

Yes, and that is the real reason to keep both in one tool. Both standards follow the same high-level structure: context, leadership, planning, support, operation, evaluation, improvement. In practice: one document control procedure, one internal audit programme, one management review, one corrective action process — not two of each. Many certification bodies allow a combined audit, which saves audit days.

Do we have to write down every process?

No. ISO 9001:2015 requires neither a process catalogue nor a quality manual — both come from older editions and persist stubbornly. What is required is that you know your processes, control them and measure their effectiveness. Where a description is missing and the result is still right, that is not a finding. Where it is missing and errors keep recurring, it is.

Does NIS2 apply to our medical practice?

As a rule, no. The thresholds are 50 employees or EUR 10 million turnover; a single or small group practice is below them. What binds there is the German IT security directive under Section 75b SGB V — it applies to every practice regardless of size and explicitly requires a firewall, among other things. NIS2 can still reach you indirectly: if you are connected to a hospital, laboratory or medical care centre that is itself in scope, requirements arrive through their supply chain.

What are the reporting deadlines?

Three, all running from the moment you become aware. Early warning within 24 hours, notification within 72 hours, final report within one month. If the incident is still ongoing when the month is up, you submit a progress report first. The most common mistake is not the missed deadline but the unrecorded start time. Write down the date and time you became aware before you do anything else.

What does NIS2 mean for management personally?

Management must approve the risk-management measures, oversee their implementation and undergo training. That duty cannot be delegated and comes with personal accountability. In practice: you need a dated, signed management decision, not an email saying "looks fine". Our NIS2 checklist has a sheet for exactly that.

Is there a NIS2 certificate?

No. NIS2 is not a certifiable standard but an obligation with supervision. You demonstrate implementation to the competent authority, not to a certification body. That makes the evidence trail more important here than under ISO: there is no certificate to show, only your documentation. Anyone selling you a "NIS2 certificate" is selling paper with no legal effect.

What does DORA consist of?

Seven areas: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, ICT third-party risk management, the register of information, information sharing, and oversight of critical third-party providers. Our DORA checklist breaks that into 50 requirements with article references, expected evidence and status.

What are the DORA reporting deadlines?

For a major ICT-related incident: initial notification no later than four hours after classification as major, and in no case later than 24 hours after becoming aware. Intermediate report within 72 hours, final report within one month. The difference from NIS2 is the starting point: DORA ties the first deadline to classification, NIS2 to awareness. If you run both, keep that distinction explicit in your incident process.

Do we have to run threat-led penetration testing?

Only some entities. Threat-led penetration testing under the TIBER-EU framework is intended for specific financial entities identified by the supervisor, at least every three years, with every third test carried out by an external provider. Everyone else needs a testing programme but no TLPT: vulnerability assessments, network security assessments, source code reviews, penetration tests in the ordinary sense.

What is the register of information?

A complete record of all contractual arrangements for the use of ICT services, at entity and group level. It goes to the supervisor periodically, with the reference date normally 31 December of the preceding year. In practice this is where projects stall: the required fields live in no single contract folder and have to be assembled from legal, procurement and operations.

Is SOC 2 the same as ISO 27001?

No, and the differences run deeper than comparison tables suggest. ISO 27001 is a standard with a certificate from an accredited body. SOC 2 is an attestation report by a CPA firm under US standards — not a certificate but a report you share with customers. Type I describes the suitability of controls at a point in time, Type II their effectiveness over a period, typically three to twelve months. European customers usually ask for ISO 27001, US customers usually for SOC 2.

What is BSI C5 and do we need it?

The German federal office's criteria catalogue for cloud services. It is not certified but attested: an auditor examines it under ISAE 3000 and issues a report, either at a point in time or over a period. It is needed almost exclusively by cloud providers serving German public sector or regulated customers. If nobody asks you for it, you do not need it.

Does ISO 27001 cover the GDPR?

Partly, and the gap is the interesting half. ISO 27001 protects information regardless of whose data it is. The GDPR asks about legal basis, purpose limitation, data minimisation, data subject rights, records of processing and data protection impact assessments. The technical and organisational measures under Article 32 overlap heavily with Annex A. Everything to do with lawfulness and the rights of data subjects has no counterpart in ISO 27001.

What use is NIST CSF 2.0 if we are based in Europe?

As an organising frame, not a certification target. The six functions — Govern, Identify, Protect, Detect, Respond, Recover — give you a language for presenting maturity to the board without reading out ISO clauses. It is also useful with US customers and insurers who ask for it. There is no certificate.

And if we use AI — ISO 42001?

ISO/IEC 42001 is the management system standard for artificial intelligence, structured like ISO 27001 and certifiable. If you already run an ISMS, leadership, risk process, internal audit and management review largely carry over. It does not replace the obligations under the EU AI Act but helps you meet them in an orderly way.

How current does evidence have to be?

As current as the cycle you set yourself. If your policy calls for an annual access review and the last one was 18 months ago, that is a nonconformity — not because the standard demands 12 months, but because you did. Hence the uncomfortable advice: set cycles you can keep. Semi-annual sounds more diligent and becomes a source of findings in year two.

Some evidence is confidential. Does the auditor have to see everything?

They have to be able to judge effectiveness, not read every detail. For personal or particularly sensitive content, redacted extracts, samples or on-screen inspection without copies are customary and accepted. Insist that this is settled before the audit, not in the audit room.

How much storage do we need for evidence?

Less than you would think, provided you keep references rather than copies. Basic includes 1 GB, Professional 10 GB, Enterprise 100 GB. Storing every screenshot at full resolution fills that faster than linking to the ticket system.

How does it work in practice?

Evidence is filed once and attached to every requirement it serves, across framework boundaries. A change takes effect on all linked requirements; when the evidence expires, it expires everywhere. The difference from a spreadsheet shows up not when you create it but a year later: there the same evidence exists in three states, here in one.

How large is the overlap really?

It depends on the pair, and honestly it can only be answered with your data. Rough experience: ISO 27001 to NIS2 overlaps heavily on the technical and organisational side; ISO 27001 to SOC 2 likewise; ISO 27001 to GDPR only where Article 32 is concerned. We deliberately quote no percentage. Anyone telling you two frameworks overlap by 80 % has either not seen your scope or is counting requirements rather than effort.

What cannot be carried over?

Anything tied to a specific legal consequence or a specific procedure. The NIS2 and DORA reporting deadlines are not identical. The NIS2 management decision does not replace an ISO 27001 management review. The DORA register of information has no ISO 27001 counterpart. Those remainders are exactly why a mapping table alone is not enough.

In what order should we tackle frameworks?

Broadest first, if you have the choice. ISO 27001 carries the most into other frameworks because both the management system and the control set get reused. After that, the second framework is mostly addition rather than new build. If a deadline is pressing, the deadline wins. NIS2 and DORA do not ask whether you did ISO first.

Does Sightadel certify us?

No. Sightadel is software for preparation and upkeep — we do not certify and we do not conduct certification audits. The certificate is issued by an accredited certification body following an audit. You choose that body freely. You can appoint your own or approach one from our partner network; the bodies in it work independently of us, and we receive no consideration for a referral that could influence their judgement. This separation is not modesty but a foundation: under ISO/IEC 17021 a certification body must be impartial and may not both consult and certify the same organisation. Offering software, consulting and the certificate from one hand creates a conflict of interest that ends up making your certificate contestable.

Does our auditor get their own access?

Yes. There is a dedicated auditor role, read-only and always external — an internal user cannot hold it. That removes the need to email evidence folders around and keeps a record of what the auditor saw. Advisors you bring in have a separate role, so that an audit never blurs who examined and who contributed.

How does a certification audit work?

In two stages. Stage 1 is essentially a document review: scope, policy, risk methodology, Statement of Applicability, audit programme. Stage 2 tests effectiveness on site or remotely, through samples and interviews. Two surveillance audits follow in the subsequent years, with recertification in year three. The cycle runs three years.

How many audit days should we plan for?

That follows from headcount and complexity and is derived by the certification body under ISO/IEC 27006. Order of magnitude for a first ISO 27001 certification: around five days up to ten employees, roughly eight to ten at 50, twelve to fourteen in the mid hundreds. Surveillance audits run at about a third and recertification at about two thirds of the initial audit time. Since the 2024 edition the derivation is more risk-based — treat these as orientation, not entitlement.

Can we run the internal audit ourselves?

Yes, as long as the person auditing does not audit their own area. Independence here means objectivity, not externality. In small organisations departments audit each other; where that is not possible, an external internal auditor is the usual route.

How do we hear about changes to standards and laws?

Three ways: as a notice in the dashboard, in the newsletter and in the news section on sightadel.com. The dashboard notice is the most targeted — it appears only for the frameworks you subscribe to, not for everything else. Each notice states what changed, what it means for your checkpoints and by when something has to be done.

FAQ — questions on ISO 27001, NIS2, DORA, audits and evidence

Getting started

Yes. There is a 14-day trial, requested through the contact form on sightadel.com. No payment details required.

Platform, editions and roles

Per framework. You license ISO 27001, NIS2 or DORA individually, each in one of three editions. The editions differ in capacity and response time — internal users, evidence storage, monitored assets, vendors, support — not in the substance of the framework.

In practice: requirements, evidence structure and audit export are identical in Basic and Enterprise.

Setting up ISO/IEC 27001

Two things that often get confused. First, clauses 4 to 10: a management system with context, leadership, planning, operation, evaluation and improvement. Second, Annex A: 93 controls across four themes — organisational, people, physical, technological.

Organisations rarely fail an audit on Annex A. They fail on clauses 9 and 10: internal audit, management review, corrective action. That is the part you cannot buy.

Setting up ISO 9001

The customer decides that, not the standard. ISO 9001 is sector-neutral and is certified for service providers as readily as for manufacturers. The usual trigger is a tender or framework agreement that lists the certificate as a condition of entry.

Setting up NIS2

The test has two stages. First the sector: does your activity fall under the listed entity types? Second the size: from 50 employees or EUR 10 million annual turnover you count as an important entity, from 250 employees or EUR 50 million as an essential one.

Regardless of size, the obligation applies to certain entities — operators of critical installations and providers of certain digital services among them. Our NIS2 checklist includes a sheet that computes the classification.

Setting up DORA

To financial entities in the EU in the broad sense — banks, insurers, investment firms, payment institutions, crypto-asset service providers and more — and to critical ICT third-party providers serving them. The regulation applies directly, since 17 January 2025, with no national transposition.

If you supply software or operations to financial entities, the requirements reach you through the contract even though you are not a financial entity yourself.

Other frameworks

ISO/IEC 27001, ISO 9001, NIS2, DORA, SOC 2, NIST CSF 2.0, BSI C5, GDPR and HACCP, plus custom frameworks. For medical practices there is a dedicated evidence pack for Section 75b SGB V.

Evidence and documents

Anything from which a third party can tell that something was actually done — with a date and an author. Minutes, a screenshot of a setting, an approval in the ticket system, a signed sheet, a log extract.

What is not evidence: a policy that mandates something. That proves intent, not implementation. This confusion is the single most common finding in a first audit.

One piece of evidence, several frameworks

That the same fact is asked for by several frameworks and you evidence it exactly once. Access management appears in ISO 27001 Annex A, in NIS2 measure 9, in DORA's ICT risk management and in the SOC 2 common criteria. That is the same question four times.

Keeping a separate folder per framework means maintaining the same evidence several times — and having it in three different states a year later.

Audit and certification

No. ISO standards are international, and a certificate to ISO/IEC 27001 or ISO 9001 is recognised worldwide provided the issuing certification body is accredited and the accreditation body belongs to the International Accreditation Forum's multilateral recognition arrangement.

Only the legal acts are European: NIS2, DORA, the GDPR and the AI Act. Those reach non-EU providers too, as soon as they supply into the EU or process data of people in the EU. Conversely SOC 2 and NIST are US-shaped and asked for worldwide.

In short: the standard is global, the obligation is regional.

Ongoing operation and framework changes

The work that decides the outcome. A certificate is a snapshot valid for three years with two surveillance audits in between. Between audits the cycles continue: access reviews, vendor assessments, training, restore tests, management review.

The classic mistake is the pause after the first audit. It shows up in the first surveillance audit, because eleven months of evidence are missing.

Security, hosting and data protection

In Germany, with our hosting provider creoline. Development, operations and support are based here as well. No detour through data centres elsewhere, no access under foreign law.

For some of our customers that is the reason they talk to us at all — and for everyone else it is at least one question fewer in the vendor questionnaire.

Pricing, contract and billing

Per framework and edition. ISO 27001 starts at EUR 9,000 per year in the Basic edition, NIS2 and DORA at EUR 4,500, ISO 9001 at EUR 3,800, BSI C5 and GDPR at EUR 2,400, HACCP at EUR 1,800. Professional is 30 % above Basic, Enterprise 60 %. All prices net.

The full list including the edition comparison is available as a PDF in the resources section.

The questions people actually ask us.