ISMS software 2026: selection criteria, obligations and EU data residency

With the transition period of ISO/IEC 27001:2022 to October 31, 2025 and the NIS 2 implementation in Germany, the operational requirements for an information security management system (ISMS) have increased significantly. 93 controls in four thematic groups (Annex A of the standard), a 24-hour early warning path and a 72-hour follow-up report according to Section 32 NIS2UmsuCG as well as the criminal liability of management according to Section 38 NIS2UmsuCG require a toolbox that does more than just filing. In 2026, ISMS software will be the operational link between standards, authorities and management. If you choose the wrong toolbox, you are creating an expensive obligation instead of creating a viable protective shield.

This guide organises the market for ISMS software, describes the mandatory functions according to standards and laws, shows typical weak points in the selection and provides an operational grid for the introduction. You will find out which modules are indispensable, where pseudo-compliance arises, what a realistic budget looks like, which interfaces remain indispensable and what role the appointed information security officer (ISB) plays in tool selection. CIVAC is a compliance platform and officer-as-a-service that covers exactly these requirements in one model, from the tool function to the order. The auditor calls, the evidence is ready., that is the claim of this guide.

An ISMS according to ISO/IEC 27001:2022 is a documented management system for controlling information security risks. It includes context and scope, an information security policy, a risk analysis with defined evaluation criteria, a statement of applicability (SoA), action plans, internal audits, management reviews and a continuous improvement process according to the PDCA cycle. The standard requires not only documentation, but proof of effectiveness for the measures taken, measurable through key figures, audits, incident analyses and reaction times in operations.

ISMS software is based on the operational control of these components. It maintains the risk register with assessment methodology, maintains the catalogue of measures with those responsible and deadlines, documents audit results, archives evidence in an audit-proof manner, provides reports for management assessment and links incidents with the affected controls. Good ISMS software connects these building blocks so that the effectiveness of a control remains traceable until the audit is established and the associated corrective action is taken. This is significantly more than an Excel list with 93 lines and a few status traffic lights in the right column.

The distinction is important: ISMS software does not replace the Information Security Officer (ISB), but rather makes it effective. Without an appointed ISB and a clear reporting line to management, even the best software remains an empty tool. The appointment of the ISB with a signed appointment certificate and a defined task profile is the organisational requirement for every software deployment. This separation between role and tool is the most common gap in initial certifications and regularly leads to audit findings in the certification body's level 1 examination. Experience has shown that anyone who does not clarify the role question in advance will postpone certification for six to nine months because the organisational maturity cannot be proven and level 2 audits are aborted. This is more expensive than any software licence.

With the 2022 revision, Annex A of ISO/IEC 27001 has been fundamentally restructured. Instead of the previous 114 controls in 14 groups, the standard now includes 93 controls in four thematic groups: organisational controls (37), personnel-related controls (8), physical controls (14) and technical controls (34). Eleven controls have been newly added, including Threat Intelligence (A.5.7), Information Security for Use of Cloud Services (A.5.23), ICT Readiness for Business Continuity (A.5.30), Physical Security Monitoring (A.7.4), Configuration Management (A.8.9), Information Deletion (A.8.10), Data Masking (A.8.11), Data Leakage Prevention (A.8.12), Monitoring Activities (A.8.16), Web Filtering (A.8.23) and Secure Coding (A.8.28). These eleven controls force many existing users to make structural adjustments in the SoA.

An ISMS software must maintain these controls as a structured list, link each control with status, person responsible, measures and proof of effectiveness and be able to automatically generate the declaration of applicability. Anyone who only manages the controls as a static table will lose track at the latest during recertification. The software must also support the mapping function for the previous version 2013, as many existing certificates still run according to the old standard and the migration must be documented. The link to BSI IT-Grundschutz, TISAX-VDA-ISA and industry-specific standards such as B3S, ISO/IEC 27017 or 27018 should also be mapped.

Linking controls with risks, assets and incidents is the heart of a modern ISMS tool. A good workspace shows with two clicks which control addresses which risk, which measures have been implemented, which employee is responsible and when the last effectiveness test took place. CIVAC provides exactly this link, including the preconfigured Annex A catalogue of the 2022 version, and automatically maps it into the predecessor. Others run compliance like a filing cabinet. We run it like software.

The NIS 2 Directive (EU 2022/2555) and its German implementation in the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) oblige affected companies to strictly report significant security incidents. The reporting cascade according to Section 32 NIS2UmsuCG provides for three stages: early warning to the BSI within 24 hours of knowledge, follow-up report with initial assessment within 72 hours and final report within one month. Around 29,500 companies in Germany fall within the scope of application, a significant proportion of which are considered "important" or "essential" facilities with different fine limits and supervisory regimes.

ISMS software must operationally support this reporting path, not just document it. In practice, this means: an incident recording form with the BSI mandatory fields, automatic calculation of the deadline upon knowledge, escalation path to management and ISB, templates for early warning, follow-up report and final report as well as an audit-proof storage of all reporting correspondence including receipts from authorities. The clock starts on awareness.

The fines for NIS 2 violations are significant: up to 10 million euros or 2 percent of global group sales for important facilities, up to 7 million euros or 1.4 percent for important facilities. In addition, there is the personal liability of the management in accordance with Section 38 NIS2UmsuCG. Anyone who works with ISMS software that does not map these reporting paths not only risks a fine, but also personal liability. CIVAC provides the 24/72 reporting path as a preconfigured workflow, so that in an emergency the software is more than a note-taking tool and the deadline is met, with automated pre-filling of the reporting fields from the risk register and the asset database.

In 2026, the choice of data residency will no longer be a detailed technical question, but rather a strategic decision with GDPR and sovereignty implications. ISMS software processes sensitive data: risk assessments, incident reports, vulnerability analyses, employee data of representatives and audit reports containing trade secrets. A US-hosted solution with Patriot Act exposure or unclear data transfer architecture is increasingly problematic for German authorities and large medium-sized companies, especially after the discussions about Schrems II and the EU-US Data Privacy Framework, whose legal certainty remains controversial.

The minimum requirements for 2026 are: hosting within the EU or EEA, conclusion of a contract with an EU processor in accordance with Art. 28 GDPR, technical and organisational measures in accordance with Art. 32 GDPR, a clearly documented sub-processor catalogue and no data transfers to third countries without an adequacy decision or standard contractual clauses with transfer impact assessment. Multi-client capability is mandatory for corporations with subsidiaries so that each entity manages its own risks, audits and incidents without the data of other clients being visible. Consolidated group reports must also be possible without mixing data.

The role model is the organisational prerequisite for clean work. Four roles are standard: ISB as the main person responsible, management as the report recipient and escalation level, those responsible for measures from the specialist departments, auditors with reading access. The software must map these roles, assign authorizations in a fine-grained manner and log all actions in an audit-proof manner. The appointment certificate, signed, filed, verifiable, also applies to the software authorisation logic: Who is allowed to do what must be recorded in writing and verifiable, and the audit log must prevent manipulation. A complete authorisation register belongs in the ISMS and not in an isolated Active Directory configuration that no one checks. Access from external consultants should also be limited in time and automatically revoked after the end of the mandate.

ISO/IEC 27001:2022 requires an internal audit program in clause 9.2, a management review in clause 9.3 and a correction and improvement process with documented measures in clause 10. These duties cannot be delegated to the software, but the software decides whether the duties can be fulfilled efficiently or lead to additional workload. Audit templates must be available per Annex A area, with checklists, assessment logic and reporting templates. Effectiveness tests must be documented by key figures, samples and incident analyses, ideally with historical trend analysis over several audit cycles.

In practical terms, this means: The software provides 490 ready-to-use audit templates, covering organisational, personnel-related, physical and technical controls, generates audit reports automatically from the completed checklists and transfers audit findings directly into action plans with responsible persons and deadlines. This means that the audit does not become an end in itself, but rather an engine for improvement with a measurable effect on the level of security. The templates should be regularly adapted to changes in standards, official information and new threat situations, without the customer having to update them themselves.

The management assessment according to clause 9.3 is the annual compilation of all ISMS key figures for the management. Good ISMS software provides the database: audit results, incidents, action status, risk changes, response times and compliance gaps. This shortens the preparation of the management review from weeks to days. The CIVAC workspace with prepared evaluations, automatically filled reports and a clear template for the management review meets this requirement without manual data preparation. Audit-proof, documented, ISO-proof are the benchmarks here. The management receives a consolidated picture in one meeting instead of having to fight through thirty slides from the security area. The supervisory boards can also quickly see whether the ISMS is alive or just being documented.

Three tool classes compete for medium-sized businesses: specialised ISMS software, broad GRC suites and home-made Excel worlds. Excel is the entry-level solution for small businesses without certification intentions. It works with few controls and a stable personnel structure, but collapses at the latest with the first recertification, in incidents that require escalation or with a change in personnel without handover documentation. The apparent cost savings belie the follow-up effort problem that becomes apparent during the first external audit and then has to be compensated for expensively.

GRC suites such as Archer, ServiceNow or MetricStream are built for large corporations with their own compliance organisation, internal tooling team and an implementation horizon of several years. They can do a lot, but they cost licence and implementation fees that rarely make sense for medium-sized businesses. A typical GRC project in a group lasts 12 to 24 months, involves an internal project team and requires external implementation consulting in the six-figure range. Overfulfillment is just as damaging as underfulfillment: too much functionality without need leads to acceptance problems.

Specialized ISMS software lies in the middle: preconfigured Annex A catalogue, audit templates, reporting paths and reporting templates, without the customer having to build everything themselves. Introduction time typically two to six weeks, licence costs depending on size and module choice. This is where CIVAC comes in: workspace with 93 controls, 490 audit templates, 24/72 reporting path and ISB ordering in one platform, with a clear SLA of two working days instead of two to six weeks for the initial analysis. Licence the workspace for your internal representatives, or have our representatives order it. This creates a toolkit that remains viable even with limited internal security capacity and does not require a dedicated implementation department. Scaling from a single company to a group of companies with several clients is also possible during ongoing operations, without data migration.

An ISMS software implementation without a clear plan costs twice as much and delivers half as much. A 90-day plan in three phases that interlinks software commissioning with organisational anchoring has proven successful. Phase 1, Days 1 to 30: Inventory, asset inventory, define risk analysis methodology, order or confirm ISB, define role model, set up software client, import master data. Experience has shown that asset capture is the bottleneck and should be started in parallel with the IT department, ideally with an automated CMDB interface.

Phase 2, days 31 to 60: Fill the risk register, evaluate Annex A controls, draw up action plans, create a statement of applicability, plan the first internal audits, configure the NIS 2 reporting path and coordinate with management. In this phase it is decided whether the software is actually used or just filled. Training those responsible for measures is mandatory, not an option, and should work with concrete use cases from your own company, not with abstract examples or generic slides from the manufacturer's kit.

Phase 3, days 61 to 90: carry out the first internal audits, create audit reports, initiate corrective measures, prepare management assessment, request external certification body for the Stage 1 audit, define training matrix for ISMS awareness. Regular operations begin on day 91 with an annual audit program, monthly ISB reporting and continuous risk monitoring. Anyone who sticks to this rhythm with the software will be ready for certification after 12 months and will have achieved a reliable level of compliance that will be used in the certification exam. It remains important to separate the software implementation project and the ISMS structure; both run in parallel with their own milestones and their own responsible person, so that neither the tool nor the system gets stuck. A weekly status point with the ISB keeps the speed high and prevents the two strands from diverging.

The same mistakes are repeated in software selection projects. First: overestimating your own performance. Many medium-sized companies believe that they can build an ISMS simply by selecting tools without clearly defining the organisational role of the ISB. The result is an expensive licence that no one maintains because responsibility remains diffuse. The appointment of the ISB with task profile and reporting line is the organisational requirement for every tool introduction, not a subsequent step after the initial configuration of the software.

Secondly: underestimating the data integration effort. ISMS software is only as good as its database. Asset inventory, supplier and service provider registers, incident history and training certificates must be transferred cleanly. Interfaces to IT asset management, HR systems and ticket systems are rarely standard and determine acceptance in the company. Those who save here build data silos instead of an integrated management system, and the ISB maintains lists instead of controlling risk. A realistic integration effort is ten to twenty person days for medium-sized companies, depending on the number of connected source systems.

Third: incorrect assumptions about hosting. Many providers advertise “EU hosting”, but operate sub-processors in the USA or other third countries, often without this being transparently documented in the contract. Before the contract is concluded, the complete sub-processor catalogue should be available, including hosting locations and data transfer mechanisms. CIVAC works exclusively with EU data residency and a transparent sub-processor directory, which can be viewed before the contract is concluded and runs in the workspace. Turning reading into an order means bringing a list of requirements with you, not checking advertising flyers. A simple check: Request a sample template for the data protection impact assessment from the provider itself, as well as the current ISMS certificate situation with scope, issuing office and period of validity. Providers who do not deliver these documents within two working days are unsuitable for processing security-relevant data.

ISMS software is just a building block. Anyone who builds a resilient compliance architecture combines tool, role and process: platform for operational control, appointed ISB for responsibility, defined processes for risk analysis, incident management and audit. Only this triangle creates audit security, NIS 2 compliance and personal liability limitations for management. Anyone who only operates one of the three elements has a beautiful façade without a supporting core and will find themselves in difficulty in explaining things to certifiers, BSI or insurers during the first serious inspection.

CIVAC is a compliance platform and officer-as-a-service that offers all three elements in one model. The workspace covers the 93 Annex A controls, 490 audit templates, the NIS-2 24/72 reporting path, the role model with ISB appointment, the management review and the EU data residency. Optionally, CIVAC takes on the role of external ISB with full liability, clear reporting line to management and an SLA of two working days for all inquiries. Licence the workspace for your internal representatives, or have our representatives appointed, depending on internal capacity and maturity level.

The next step is a 30-minute inventory: current tooling situation, ISB status, risk maturity, NIS 2 impact, certification intent. This creates a concrete proposal with a module mix, licence path and ordering option. Turn reading into a mandate.: Write to info@civac.de or use the contact form on civac.de. The answer will come within two working days, with specific licence and ordering options instead of general advice offers. The appointment certificate, signed, filed, verifiable, is the benchmark. If you want a clean initial state, start with a maturity level analysis as the basis for the module design and the ordering question, with a clear view of how NIS 2 is affected and the group requirements.