Solutions · Software and IT service providers
If you provide software, cloud services or IT operations, you are vetted before every major contract. Questionnaires, certificates, audit reports, contract clauses. On top of that comes NIS2 for cloud providers, data centres and managed service providers. Sightadel guides you through ISO 27001, SOC 2 and BSI C5, keeps the evidence together across the audit period and shows your status in the Trust Center.
Starting point
For software and IT service providers, information security is part of the product. Customers give you data, access or entire business processes. Before they do, they want to know how you handle them. This shows up in sales: purchasing sends a security questionnaire with a hundred questions, the legal department demands contract annexes, the customer's IT wants to see certificates and reports.
The questions are almost always the same, just worded differently. Even so, many providers answer every questionnaire by hand, spread across development, operations and management. That takes time away from the product, and answers end up contradicting each other. A certificate or audit report shortens these rounds but does not replace them entirely.
Which proof is the right one depends on your customers. In the German-speaking and European market, ISO 27001 is the usual benchmark. Customers in the USA ask for SOC 2. Healthcare and the public sector expect cloud providers to have an attestation under BSI C5, the cloud criteria catalogue of the German Federal Office for Information Security (BSI). Over time, many providers need more than one of these. If you build them on a common foundation, you do most of the work only once.
Why now
The deal is within reach, but purchasing requires a certificate or an audit report. Without proof, the deal is delayed or falls through altogether. The deadline is often already in the offer.
US customers almost always ask for a SOC 2 report. An ISO certificate is often accepted, but does not answer all the questions of their security departments.
Public contracting authorities and healthcare providers ask cloud services for BSI C5. For processing health data in the cloud, a current attestation is a prerequisite.
Cloud providers, data centres and managed service providers belong to the sectors of high criticality in the German BSI Act (BSIG). From medium size, they are important entities; from large size, essential entities.
Even if you are not covered yourself, the requirements reach you through your customers. Banks, insurers and companies subject to NIS2 must assess their service providers and bind them contractually.
Investors and buyers review information security in due diligence at software companies. A well-maintained ISMS answers these questions without extra shifts.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
The standard for information security in the European market and the common foundation for all further proof. The certificate from an accredited body is valid for three years, with annual surveillance audits. For many providers, the first goal.
View framework →Requested as soon as customers in the USA or internationally operating corporations come on board. Type I describes the design of the controls at a specific date, Type II their effectiveness over a period. The report is issued by a CPA firm. With an existing ISO 27001 ISMS, a large part of the controls is already in place.
View framework →For cloud providers with customers from healthcare, the public sector or regulated industries. C5:2026 has applied since spring 2026. For audit periods starting on or after 1 June 2027, only the new edition is permitted. The attestation is issued by an independent auditor (certified public accountant) under ISAE 3000.
View framework →Providers of cloud services and data centres belong to digital infrastructure, managed service providers and managed security service providers to ICT service management. Both sectors are listed in Annex 1 of the BSIG. Online marketplaces, search engines and social networks are covered as digital service providers in Annex 2. Certain services fall under it regardless of size.
View framework →If you process personal data on behalf of customers, you are a processor. This entails contracts under Art. 28 GDPR, a list of sub-processors, technical and organisational measures and a process for personal data breaches that also informs customers in good time.
View framework →For providers whose product includes AI features. Customers increasingly ask how models are selected, data is used and risks are assessed. A management system under ISO/IEC 42001 builds on the same structure as ISO 27001.
View framework →Recommended order
Which customers do you want to win, and what do they require? That determines the order. Usually ISO 27001 is the first step, followed by SOC 2 or C5. In parallel, you check whether your operations fall under NIS2.
Which product, which environments, which sites and which subcontractors are included? For SOC 2 and C5, this results in the system description. A narrow, well-justified scope is better than a broad one that is not lived.
Risk analysis, policies, access control, secure development, change management, logging, backups and incident handling. Much of this has long been running in development and operations and only needs evidence with a date.
For SOC 2 Type II and C5 Type 2, what counts is that controls were effective over months. Access reviews, onboarding, offboarding and changes need continuous evidence. If you only start collecting shortly before the audit, you will not cover the period.
The ISO certificate is issued by an accredited certification body, the SOC 2 report by a CPA firm, the C5 attestation by an independent auditor. Auditors get their own role in Sightadel and can never delete anything.
Certificates, approved policies, security measures and subcontractors are listed on a dedicated page. Sales refers customers there instead of answering every questionnaire from scratch.
Focus
For software and IT service providers, security questionnaires are part of sales. They cannot be abolished, but they can be answered much faster.
The answers to typical customer questions are already in the ISMS: where the servers are, who has access, how data is encrypted, how often backups run, how incidents are reported. Once these answers have been reviewed and evidenced, nobody has to reword them.
In the Trust Center, you show certificates, policy summaries, security measures and subcontractors. You release confidential material such as audit reports or network diagrams only on request.
Hosting, email delivery, monitoring, support tools. Customers want to know who else sees their data. The vendor module manages your subcontractors with assessment and evidence, and the Trust Center shows the current list.
Some customers send their own requirement catalogues, which recur. You map them as a custom framework, also via import from Excel or Word, and link existing evidence instead of searching again.
How Sightadel helps
A dedicated page with frameworks, approved documents, security measures and subcontractors. Your customers' purchasing teams find the answers themselves instead of waiting for a completed questionnaire.
Learn more →ISO 27001, SOC 2 and C5 are worked through control by control. Where requirements overlap, one piece of evidence is linked to several frameworks, for example the access review to ISO 27001 and SOC 2 at the same time.
Learn more →Evidence carries date, version and expiry date. Recurring controls run as a cycle, and Sightadel reminds you before a date in the audit period passes.
Learn more →Hosting providers, cloud platforms and other subcontractors are managed with criticality, questionnaire and evidence including validity date. This feeds the list in the Trust Center.
Learn more →Sightadel checks the externally visible attack surface of your domains and shows every issue with remediation guidance. Customers use exactly this view when they assess you from outside.
Learn more →You set up customer-specific catalogues and internal requirements as a custom framework. Existing Excel and Word files can be imported.
Learn more →The view from outside
Hardly any security questionnaire leaves out the question of how often you check your applications for vulnerabilities and when the last penetration test took place. Together with veyrisk, we offer the tests for this. You store reports and remediated findings as evidence in Sightadel and release them via the Trust Center as needed.
Software, cloud and managed service providers
The tests can be booked independently of your Sightadel licence. You receive the offer after a short conversation.
Request consultationEffort and duration
The ranges are based on experience, not a commitment. The biggest factors are the size of the scope, the number of subcontractors and how much time development and operations can spare alongside product work.
What you license · typically Professional
A typical SaaS provider with customers in Europe and the USA manages ISO 27001 and SOC 2 in the Professional edition. It includes ten users, ten assets and 25 vendors. If ISO 27001 is included, there is a permanent discount on SOC 2. Smaller teams with one product often manage with Basic. You add BSI C5 when customers require it.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
With the proof your most important customers require. For customers in Germany and Europe, that is usually ISO 27001; for customers in the USA, SOC 2. If you serve both markets, you often start with ISO 27001, because the ISMS forms the basis for SOC 2. In Sightadel, both frameworks use the same evidence.
The part you are responsible for. The data centre and physical security are covered by the cloud provider with its own certificates and reports. Configuration, access, application security, backups and incident handling are your responsibility. You store the provider's evidence in the vendor module and refer to it.
That depends on how your service is classified and how large your company is. Cloud computing services, data centres and managed services are listed in Annex 1 of the BSIG, online marketplaces, search engines and social networks in Annex 2. Not every software as a service is automatically a cloud computing service within the meaning of the law. The classification is a legal question for your advisers.
From medium size, you are covered yourself, with registration with the BSI, risk management, reporting obligations and management accountability. Your access to customer systems is a particular focus, because an attack on you hits many customers at once. In addition, your customers require evidence because they have to assess their supply chain.
It takes the recurring questions out of the process. How much time that saves depends on your customers; we do not give a flat figure. Experience shows that some individual questions remain. The customer finds the standard questions on certificates, hosting, encryption and subcontractors themselves.
The attestation remains valid. For audit periods starting on or after 1 June 2027, only C5:2026 is permitted. Plan the delta work in good time before the next audit period. In Sightadel, you map existing measures to the new criteria and see what is new or tightened.
As Contributors, they work only on their tasks and upload evidence there, for example an extract from the pipeline or a log of the access review. There is no integration with development tools. Anyone who needs more of an overview sees the status of all frameworks in the dashboard.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
