Every file here comes from real implementation work: controls, evidence, deadlines. Fill it in and take it into the audit. Request what you need – we will send it to you.
A working aid, not legal advice. Each document helps with implementation but does not replace a legal review of your specific case. The regulations in their current version are authoritative.
ISO 27001Checklist · XLSX, PDF
ISO 27001:2022 – Statement of Applicability and maturity level
All 93 controls from Annex A with applicability, justification, status and owner. Plus 28 controls from clauses 4 to 10, each with the evidence an auditor will want to see. The evaluation calculates the maturity level for each topic area.
How to use it: go through the controls once with IT and the business units and mark what applies and what is missing. The justifications for exclusions are the core of your Statement of Applicability – word them carefully.
93 controls · 28 clause controls
NIS2Checklist · XLSX, PDF, DOCX
NIS2 – checklist for § 30 BSIG
The ten measures from section 30 of the German BSI Act (BSIG), broken down into 40 verifiable points with evidence, status and owner. With a calculator for the three reporting deadlines and a sheet for the management resolution on implementation.
How to use it: first establish whether you are affected. Then enter an owner for each control and put the sheet to management for a resolution on implementation once the status is reliable.
10 measures · 40 controls · deadline calculator
NIS2Templates · DOCX, PDF
NIS2 – reporting templates 24 h / 72 h / 1 month
Three fillable templates following the statutory deadlines: early warning, notification, final report. Each contains the mandatory information and the fields that otherwise get forgotten during an incident.
How to use it: store the templates where your incident response team will find them in an emergency, and fill in fixed details such as contact persons in advance. Rehearse a report once as part of an exercise.
3 reports · early warning, notification, final report
DORAChecklist · XLSX, PDF
DORA – implementation and evidence checklist
50 requirements from Regulation (EU) 2022/2554, sorted by the seven areas. Each row names the article, the expected evidence and the status. With a deadline sheet for the reports.
How to use it: assign each requirement to one of the seven areas and to an owner. The article reference helps you get to the right place quickly in discussions with supervisors and auditors.
50 requirements · 7 areas · article reference
§ 390 SGB VEvidence pack · XLSX, PDF
§ 390 SGB V – evidence pack for medical practices
The IT security guideline of the German National Association of Statutory Health Insurance Physicians (KBV) in 49 controls across eleven topic blocks. You enter your practice size once, then the file shows only the points that apply to you, including annexes 1 to 5.
How to use it: enter your practice size, then go through the points shown with your IT service provider. Keep the completed file with the annexes so you can demonstrate implementation on request.
49 controls · by practice size · German only
ISO 9001Guide · PDF
ISO 9001 in 3 months
A roadmap in three phases from the initial assessment to the certification audit. What needs to be ready when, which documents the standard really requires and where projects usually stall.
How to use it: read the guide before the project starts and set your milestones based on the three phases. The notes on typical pitfalls are particularly useful when planning the internal audit.
Guide · 3 phases
Ongoing operationChecklist · PDF
Six things between audits
What has to happen regularly between two audits: reviewing access rights, reassessing critical vendors, training, testing recovery, internal audit and management review, updating risks – each with reference to ISO 27001 and NIS2, frequency and evidence.
How to use it: enter the six points as recurring appointments. In Sightadel they are set up as cycles with reminders.
Why compliance in spreadsheets fails as soon as a second regulation is added. How controls, evidence and deadlines can be managed so that an audit is no longer a project – and what software cannot do for you.
How to use it: as a basis for internal discussion when you need to explain to management or colleagues why spreadsheets reach their limits with several regulations.
White paper
There is currently no material on this topic.
Material and platform
The file to get started. Sightadel to keep it running.
The checklists are complete and can be used without Sightadel. They are a good way to gauge the scope. As soon as several people, evidence and deadlines come into play, a file reaches its limits.
With the checklist
Quickly see scope and gaps
Discuss the effort with management
Start without an account or software
Good for an initial assessment
In Sightadel
The same controls, already set up and with guiding questions
Evidence attached to the control, with version and expiry date
Gaps become action plans with a deadline
Several frameworks share evidence
The auditor reviews in the system and never deletes
The transition
If you have already filled in a checklist, the work is not lost. With the Excel import you bring your spreadsheets into Sightadel and carry on where you left off.
The 14-day free trial shows you how this looks with your own data.
Request
How the files reach you.
Choose the format for the material. Most files download immediately; on request we also send them by email.
The materials are working files, not samples. You can adapt and extend them for your organisation, use columns for your own owners and take the current status into the audit.
Regulations change. The current text of the regulation is always authoritative and, if in doubt, a legal review of your specific case. Before the audit, check whether anything has changed since the material was last updated.
Looking for something that is missing here? Write to us via the contact form. We add what is frequently requested.
Read on
What is behind it.
The checklists show what is required. How Sightadel guides you there step by step is explained on the framework pages.
We use Matomo to measure how our website is used so that we can improve it. Matomo is operated for us by the service provider netalytics on our behalf; the data is not used for advertising. Without your consent, Matomo counts visits without cookies and with a shortened IP address. With your consent, Matomo also sets cookies to recognise returning visits; you can withdraw at any time via “Cookie settings” in the footer. We respect the “Do Not Track” browser setting. Technically necessary storage (e.g. your light/dark choice) does not require consent. More in our privacy policy.
