Solutions · Security officers and CISOs
As information security officer or CISO, you keep the ISMS running, answer customer questionnaires, prepare audits and report to management. Sightadel brings requirements, risks, evidence and measures together in one place, even when several frameworks apply at the same time.
Starting point
In many companies, the ISMS is a collection of files. One spreadsheet for the Statement of Applicability, one for risks, one for vendors, plus folders of policies and a mailbox full of evidence. That works as long as one person keeps it all in their head. It becomes tedious as soon as a second framework is added, a colleague is off sick or the auditor asks when a piece of evidence was last reviewed.
NIS2 has made things more demanding still. Many companies now have to maintain ISO 27001, meet the obligations of the German BSI Act (BSIG) and prove their technical measures under the GDPR – all at the same time. The topics overlap heavily. So should the documentation: one piece of backup evidence that counts for all three, instead of three copies in three different states.
On top of that, the role sits between all chairs. You need input from IT, HR, purchasing and the business units, yet none of these departments reports to you. Sightadel makes responsibilities and deadlines visible without you chasing every task by email. And it gives management a status they can read without explanation.
Why now
You run an ISMS under ISO 27001 and now also fall under the German BSI Act. The reporting chain, registration and management duties are new. Everything else should not be documented twice.
The auditor wants to see that the system is alive: internal audits, management review, updated risks, closed corrective actions. Evidence that was valid a year ago may not be today.
Your predecessor has left and the files are scattered. Before you can improve anything, you need to understand what exists, what applies and what is out of date. An orderly import is faster than starting over.
Every major customer sends its own supply chain questionnaire. The questions are similar, the formats are not. A well-maintained status and a Trust Center answer the usual questions once for everyone.
NIS2 and ISO 27001 require you to assess service providers and set out security requirements in contracts. Without a central list with validity dates, an expired certificate is only noticed when someone asks for it.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
The framework most ISMS are built on. Clauses 4 to 10 govern the management system, Annex A contains 93 controls in four themes. The certificate is valid for three years, with two annual surveillance audits followed by recertification. Internal audits and the management review are where systems most often show weaknesses in the audit.
View framework →Mandatory for important and essential entities under the German BSI Act. The ten areas of measures under section 30 BSIG largely match Annex A. What is new is mainly registration with the Federal Office for Information Security (BSI), the reporting chain of 24 hours, 72 hours and one month, and the management duties under section 38.
View framework →The technical and organisational measures under Art. 32 can be proven with the same evidence as many controls from Annex A. A security incident can also be a personal data breach. That is why close coordination with data protection pays off.
View framework →For cloud providers whose customers come from the public sector, healthcare or regulated industries. The BSI criteria catalogue builds on ISO 27001 and adds cloud topics. The result is an attestation by an independent auditor (certified public accountant).
View framework →Takes precedence over NIS2 for financial entities. ICT risk management, incident handling and access control build on the same foundations as the ISMS. The register of information on ICT service providers and the resilience tests are added.
View framework →Recommended order
Your existing Statement of Applicability, risk lists and vendor spreadsheets come into Sightadel via Excel or Word import. You upload policies and records to the evidence archive and map them to the requirements. That way you quickly see what is already there.
Set up ISO 27001, NIS2 and, if needed, the GDPR at the same time. A piece of evidence is stored once and linked to every requirement it covers. What is already done for one framework shows up as evidenced in the other.
Risks are assessed with a fixed method, given a treatment and owners, and linked to measures. The same inputs lead to comparable results. You have accepted residual risks confirmed by management.
Gaps become action plans with owners and deadlines. Colleagues from IT, HR and purchasing get the Contributor role and work on their part directly. You invite external service providers and consultants with their own role.
Access reviews, training, vendor assessments, emergency tests, internal audit and management review run as recurring cycles with fixed dates. Evidence carries an expiry date, and Sightadel reminds you before it expires.
An honest internal audit a few weeks beforehand reveals the last gaps. The external auditor gets their own access, sees requirements, answers and evidence in context and can comment, but never delete.
Your day-to-day
Building the ISMS is a project. Running it is routine, and that is exactly where most time is lost without a system.
A restore test from 14 months ago, a training list from last year. Every piece of evidence in Sightadel has a validity date. What expires soon appears as a task, not as a finding in the audit.
The same policy in three versions for three frameworks. In Sightadel it exists once, with version and approval, linked to every requirement it covers.
Handing out tasks by email and tracking them in your calendar. Action plans with owners and deadlines replace that. You and management see overdue items without having to ask.
A new presentation for every meeting. The dashboard shows progress per framework, open issues and overdue measures. Management follows along with the Viewer role, and you add the context.
Who changed this and when, and where is the evidence? The activity log answers the first question, the evidence archive the second. The auditor sees both through their own role.
How Sightadel helps
Every requirement is phrased as a question with an explanation, control by control. Answer, justification and evidence sit in the same place. That helps with the Statement of Applicability as much as with input from colleagues who do not know the standard.
Learn more →Evidence with version, status and validity date. One piece of evidence can be linked to requirements from several frameworks, for example a backup concept to ISO 27001, NIS2 and the technical measures of the GDPR at once.
Learn more →Gaps from assessments, internal audits and external findings become measures with an owner and a deadline. Creating, changing and closing them is recorded in the activity log, with time and person.
Learn more →Service providers with criticality, questionnaires, contracts and evidence in one list. Expired certificates and missing answers stand out. This covers the NIS2 supply chain obligation and the corresponding controls from Annex A.
Learn more →The Security Score shows the external attack surface of your domains as a grade and a number, with a list of concrete issues and remediation guidance. Findings are worked on with a status and feed into your vulnerability management.
Learn more →You set up internal requirements, group policies or security annexes from major customers as a custom framework. They sit alongside ISO 27001 and NIS2 and use the same evidence.
Learn more →Effort and duration
The ranges are based on experience, not a commitment. The biggest factors are your starting point, the size of the scope and the time you have alongside day-to-day business.
What you license · typically Professional
A company with an ISMS under ISO 27001 and NIS2 obligations takes both frameworks in the Professional edition. It includes ten users, ten assets and 25 vendors. Because ISO 27001 is included, there is a permanent discount on NIS2. The GDPR can be added later and uses the same evidence.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
Yes. The Statement of Applicability, risk lists and vendor spreadsheets can be imported from Excel, policies from Word. You then map documents to the requirements. You do not start from scratch, you bring order to what exists.
Each framework has its own requirements and its own progress. Evidence and measures, however, are created only once and linked to all matching requirements. We deliberately do not give a figure for the overlap, because it depends on your scope.
Through the external Consultant role. Your consultant works directly in your account, and the activity log records that the access came from outside. If you do not have a consultant, you can book consulting as a package in the app.
The auditor gets a role of their own. They see requirements, answers, evidence and the activity log, add comments and – once you approve – create or edit entries. They can never delete anything. That saves preparation time and sending files back and forth.
An independent, accredited certification body. You choose one from our partner network in the app or bring your own. Sightadel does not certify, and no commission is paid for audits, neither to us nor to the partners.
Yes. The audit programme is planned as a recurring cycle, findings become measures with a deadline, and the results feed into the management review. The internal audit should be carried out by someone who did not build the audited area themselves.
It provides drafts from industry templates and offers drafting help. Not everything is pre-filled, on purpose. You make the risk assessment, decide on residual risks and which controls apply yourself. That is exactly what the auditor checks.
Sightadel is developed in Germany and operated in Germany. We conclude a data processing agreement (DPA) under Art. 28 GDPR with every customer.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
