ISMS according to ISO 27001:2022 — from gap analysis to certification
An ISMS is not a paper exercise — it is the operational backbone of your information security.
ISO 27001:2022 has redefined the rules: 93 controls in 4 categories (organizational, people, physical, technological) replace the previous 114 controls in 14 groups. 11 new controls — including Threat Intelligence, Cloud Security, and Data Masking — reflect current threat landscapes. The transition deadline was October 2025, yet many organizations are still struggling with implementation.
Our expert consultants provide comprehensive information security management strategy services tailored to your organization's specific needs. We combine deep regulatory expertise with practical implementation experience to deliver measurable results.
6 service modules
Bookable individually or as an end-to-end programme.
Complete ISMS implementation from risk methodology through policies and processes to technical controls. Including Statement of Applicability, asset management, and documentation framework — certification-ready in 6–12 months.
Migrating your existing ISMS to ISO 27001:2022: mapping the new 93 controls, integrating the 11 new requirements (Threat Intelligence, Cloud Security, ICT Readiness for Business Continuity), and closing audit findings.
From pre-audit readiness review through Stage 1 document review to on-site Stage 2 accompaniment. We know the typical pitfalls and prepare you specifically — including follow-up on minor/major non-conformities.
For automotive suppliers: preparation for the TISAX assessment according to VDA ISA. We identify the gaps between your existing ISMS and TISAX-specific requirements (prototype protection, data protection, integration with OEM processes).
Smooth integration of your ISMS into existing ISO 9001 or ISO 14001 systems. Harmonization of documentation, audit cycles, and management reviews — for an integrated management system without duplication of effort.
Alternative or complement to ISO 27001: building an ISMS based on the BSI IT-Grundschutz Compendium. Particularly relevant for KRITIS operators and public institutions that require the BSI standard as evidence of compliance.
6 phases
Every organization is different — your ISMS must reflect that. We work iteratively, pragmatically, and always with certification in mind.
Assessment of the current state against ISO 27001:2022, identification of critical gaps, and definition of the ISMS scope
Systematic risk analysis and derivation of applicable controls from Annex A
Development of policies, processes, and technical controls — aligned with your IT landscape and organization
Embedding a security culture — from the board to student interns
Assessment of ISMS effectiveness and preparation for the external certification audit
Stage 1 + Stage 2 audit preparation, on-site accompaniment, and follow-up on findings
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
Contact our specialists today for a personalized assessment of your requirements.
6 QUESTIONS, BRIEFLY ANSWERED
ISO 27001 is an international standard with a risk-based approach — you define which controls are relevant. BSI IT-Grundschutz is more detailed and prescribes specific measures (building blocks). ISO 27001 is globally recognized and suitable for international organizations. BSI IT-Grundschutz is particularly prevalent in Germany, especially among KRITIS operators and public authorities. Both can be combined: an ISO 27001 certification based on IT-Grundschutz combines the advantages of both approaches.
The typical timeframe is 6–12 months from project start to a successful Stage 2 audit. The duration depends on the current maturity level, the scope, and the available internal resources. Organizations with an existing management system (e.g., ISO 9001) can often achieve certification faster, as structures such as internal audit and management review are already established.
The pure certification costs (auditor fees) range from EUR 10,000–30,000 depending on company size and scope. The larger investment block is preparation: internal resources, consulting, tool implementation, and training. A realistic total budget for a mid-sized company is EUR 50,000–150,000. ADVISORI helps deploy this budget efficiently and avoid overengineering.
NIS2 does not mandate a specific framework, but requires systematic risk management, incident management, supply chain security, and governance structures — all core elements of an ISMS based on ISO 27001. In practice, an ISO 27001 certification is the most efficient way to demonstrate NIS2 compliance. In addition, management bears personal responsibility for cybersecurity — another reason for a structured ISMS.
The key changes concern Annex A: instead of 114 controls in 14 groups, there are now 93 controls in 4 categories (organizational, people, physical, technological). 11 new controls have been introduced, including Threat Intelligence, Cloud Security, ICT Readiness for Business Continuity, and Data Masking. The transition deadline was 31 October 2025 — certifications based on the 2013 version are no longer valid.
TISAX (Trusted Information Security Assessment Exchange) is the information security standard of the automotive industry, based on the VDA ISA questionnaire. If you are a supplier or service provider for OEMs such as VW, BMW, or Mercedes, a TISAX assessment is generally a prerequisite for collaboration. TISAX and ISO 27001 have significant overlaps — an existing ISMS considerably facilitates TISAX readiness.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance