Tailored solutions for mid-sized companies
In mid-sized companies, one person often looks after information security, data protection and quality, usually alongside their actual job. At the same time, NIS2, customer audits and questionnaires keep arriving. Sightadel guides you through the frameworks, links each piece of evidence to every requirement it meets and shows management where things stand.
Starting point
Mid-sized companies rarely have their own information security department. The task sits with the head of IT, with quality management or with someone from management. External service providers look after the network, servers or software. Knowledge of how the company actually works is spread across a few people.
Requirements come from several directions at once. The new German BSI Act (BSIG) has applied since December 2025, and many companies with 50 or more employees or more than €10 million in turnover and balance sheet total are covered as important entities. Large customers ask for an ISO 27001 certificate or send their own catalogues. Data protection applies anyway.
Handling each requirement separately means doing a lot of things twice. Access rights, backups, training and vendor management appear in ISO 27001, NIS2 and the GDPR. With a shared foundation, each piece of evidence is created once and counts for every framework that asks for it.
Why now
The BSIG covers many sectors that previously had no obligations, such as machinery, electronics, chemicals, food, logistics and waste management. From medium size, registration, risk management and reporting obligations apply.
The contract or the tender makes a certificate a condition. There is often a date by which the proof has to be in place.
Customers subject to NIS2 or DORA have to assess their suppliers. The questionnaires land with you, and each one looks a little different.
Under section 38 BSIG, management approves the measures, monitors their implementation and takes part in training regularly. It needs a reliable overview to do that.
If the knowledge sits in an Excel file and in one person's head, every change of staff means starting the search again. A maintained system stays when people change.
Cyber insurers and banks ask about measures such as backups, multi-factor authentication and an emergency plan before signing or renewing. Answers backed by evidence make that conversation easier.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
Whether you are covered depends on sector and size. Important entities start at 50 employees or more than €10 million in turnover and balance sheet total, essential entities at 250 employees or more than €50 million in turnover and €43 million balance sheet total. This includes registration with the BSI, risk management under section 30 BSIG and reports within 24 hours.
View framework →The usual proof towards customers and the best foundation for NIS2. The certificate from an accredited body is valid for three years, with annual surveillance audits. Many measures from section 30 BSIG reappear in Annex A.
View framework →Applies to every company that processes personal data. This includes the record of processing activities, contracts with processors, technical and organisational measures and a process for data breaches.
View framework →Many mid-sized companies are already certified to ISO 9001. You reuse document control, internal audit and management review for ISO 27001 instead of building a second system.
View framework →Recommended order
Does your company fall under NIS2, and what do your most important customers require? The free NIS2 check gives a first classification. The legal assessment of your individual case stays with your advisers.
One person is responsible for the topic and has time for it. Management approves the objectives. IT, HR and purchasing contribute, and external service providers work on their own tasks.
Risk analysis, policies, access, backups, emergency plan and vendors. With ISO 27001 as the framework, you cover most of NIS2 and the technical measures of the GDPR at the same time.
Whatever is missing becomes a task with a deadline and a responsible person. A lot is already in place and only needs evidence. What is new is usually whatever nobody has written down so far.
For ISO 27001, an accredited certification body carries out the audit. For NIS2, you keep the documents ready for the BSI. Customers receive the certificate and answers via the Trust Center.
Focus
In mid-sized companies, available time decides. Four things help keep the topic from depending on a single person.
Evidence of your backups counts for ISO 27001, NIS2 and the GDPR. You file it once and link it to every requirement it meets.
HR uploads the training records, the IT service provider the backup logs. Everyone sees only their own tasks and does not have to learn a new tool.
The dashboard shows progress per framework, open tasks and overdue deadlines. Management follows along as Viewer and does not have to ask for reports.
For difficult questions such as the scope or the risk assessment, you add consulting as a package. If you have requirements the standard does not cover, we adapt Sightadel by arrangement.
How Sightadel helps
ISO 27001, NIS2 and the GDPR are worked through question by question, with an explanation and answer options. Where requirements overlap, you see it straight away and answer them once.
Learn more →Policies start from a template for your industry. The AI suggests wording based on what you have already entered. Decisions the standard requires from you stay marked.
Learn more →Every gap becomes a task with a deadline and a responsible person. Sightadel sends a reminder before it expires, and management sees what is overdue.
Learn more →Evidence carries a date, version and expiry date and is linked to every control it supports. In the audit, you find each piece of evidence in the same place.
Learn more →IT service providers, cloud services and maintenance partners are listed with risk, contract and evidence. The assessment serves NIS2, ISO 27001 and the GDPR at the same time.
Learn more →Sightadel checks how your domains look from the outside and shows each problem with instructions for fixing it. You can pass the report on to your IT service provider.
Learn more →By arrangement
Many mid-sized companies work to requirements from a parent company, a major customer or their own processes. You set up much of this in Sightadel yourself. Whatever goes further, we implement for you by arrangement. Scope and costs are set out in a quote beforehand.
Companies with group requirements, large customer catalogues or their own processes
Every customisation starts with a conversation. Work only begins once scope and costs are agreed.
See customisationEffort and duration
The ranges are based on experience, not a commitment. The biggest factors are the number of sites, the size of the scope and how much time the person in charge can spare alongside day-to-day business.
What you license · typically Professional
A typical mid-sized company subject to NIS2 manages NIS2 and the GDPR together with ISO 27001 in the Professional edition. It includes ten users, ten assets and 25 vendors, enough for management, IT, HR and purchasing. Licence for ISO 27001: from €750 per month. Because ISO 27001 is included, NIS2 and the GDPR cost permanently less. With several companies in the group or many vendors, Enterprise is the right fit.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
That depends on two questions. Does your activity belong to one of the sectors in Annex 1 or 2 of the BSIG? And do you have at least 50 employees or more than €10 million in turnover and balance sheet total? If both apply, you are usually an important entity. The NIS2 check gives a first classification; clarify the legal assessment with your advisers.
It is a very good foundation, but it does not replace the legal obligations. Registration with the BSI, reporting obligations and the training obligation for management come on top. In Sightadel, you see which NIS2 requirements your ISMS already covers.
Yes. Your IT service provider works on their tasks as a Contributor and uploads evidence there. Responsibility stays within the company, and the work is shared among those who can do it.
For the build-up, many companies plan a few hours a week for the person in charge over several months. After that, it is about upkeep: renewing evidence, working through tasks, reviewing once a year. An exact figure depends on the scope.
Yes. You run context, leadership, document control, internal audit and management review jointly for both standards. What is new is mainly the risk analysis and the measures from Annex A.
You create it as a custom framework, including by import from Excel or Word, and link existing evidence. If the catalogue is very extensive, we can prepare it for you by arrangement.
You set up a lot yourself, such as responsibilities, deadlines, reminders and custom frameworks. Anything beyond that, such as a further integration or a specific report, we discuss with you and implement based on a quote.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
