ISO basic certificate: Your roadmap to certification
Valid until October 8, 2026 4:34 AM
1. The company
Entering the basic company data on your certification platform is a key step on the way to ISO certification. This includes analysing the company environment. Previously, this was complex and meant weeks of work. That's a thing of the past! Our AI assistant has already created the necessary basics for you.
|
Description of the company and the information security requirements | Documentation created |
|
Our information security policy | Documentation created |
|
Declaration of applicability for ISO 27001 | Documentation created |
|
These individuals and groups are affected by our information security management system | Documentation created |
|
List of information classification (Annex A, 5.12) | Documentation created |
|
Inventory: Work equipment, software applications and IT infrastructure relevant to our information security (Annex A, 5.9) | Documentation created |
|
The scope of our information security management system | Documentation created |
Company / Management
Our managers are committed to consistently implementing the principles of ISO 27001 (information security management) in their daily work. Managers ensure the confidentiality, integrity and availability of information by adhering to proven security standards. Our management principles are essential for our commitment to information security. They form the basis for responsible and exemplary management behaviour in our organisation.
|
The management's responsibility for information security | Documentation created |
|
Definition of goals for information security | Documentation created |
|
Integration of information security management into our business processes | Documentation created |
|
Commitment to the continuous improvement of our services | Documentation created |
|
We actively address the risks and opportunities of our business activities | Documentation created |
|
We monitor the results of our business activities | Documentation created |
|
We provide the necessary resources to fulfil our obligations | Documentation created |
|
Creation and maintenance of guidelines | Documentation created |
|
Managers undertake to comply with standards, regulations and laws | Documentation created |
2. Goals
Entering and editing your goals is an important step in setting your direction and documenting your progress. This is also very simple, as the goals you have given us in the questionnaire have already been created.
|
Our goal: We want to ensure our customers' trust in our information security | Documentation created |
|
Our goal: Raising the standard for information security in the company | Documentation created |
|
Our goal: professionally manage information security risks | Documentation created |
|
Our goal: Raising awareness of information security | Documentation created |
|
Our goal: to ensure an immediate response in the event of incidents | Documentation created |
|
Our goal: Ensure compliance with legal requirements and conditions | Documentation created |
|
Our goal: Avoid security and data protection incidents | Documentation created |
3. Processes
While you were filling out the questionnaire, we already created your process landscape. The processes and procedures are assigned to the different areas of your company. Now it's just a matter of putting the finishing touches to them: Further elaborate your processes and customise them to suit your company.
|
Our purchasing and procurement process | Documentation created |
|
Our development process for ensuring information security (Annex A, 8.28, 8.29, 8.30, 8.31) | Documentation created |
|
Regulatory process for breaches of information security (Annex A 6.4) | Documentation created |
|
Our process for assessing information security risks | Documentation created |
|
Our process for dealing with information security risks | Documentation created |
|
Our process for registering new users and granting access (identity management) | Documentation created |
|
Our process for de-registering (removing) users from our systems (identity management) | Documentation created |
|
Management of secret authentication information / identity management / endpoint devices (Annex A, 5.17, 5.18,8.1,8.5) | Documentation created |
|
Our process for labelling information (Annex A, 5.12) | Documentation created |
|
Our process for handling assets (hardware, software) (Annex A, 5.10) | Documentation created |
|
Our process for dealing with information security in the supply chain (Annex A, 5.21) | Documentation created |
|
Our process for acquiring, using, managing and exiting cloud services (Annex A, 5.23) | Documentation created |
|
Emergency plan for information security incidents, events and occurrences (Annex A, 5.25, 5.26, 5.27, 5.29) | Documentation created |
|
Our process for handling data protection requests for information from data subjects | Documentation created |
|
Operating process/operating procedures Change management: Changes to IT systems (Annex A, 5.37, 8.32) | Documentation created |
|
Operating process/operating procedures Protection against malware and malicious software (Annex A, 5.37,8.7) | Documentation created |
|
Operational process/procedures Information security training (Annex A, 5.37, 6.3) | Documentation created |
|
Operating procedure/Backup and recovery (Annex A, 5.37, 8.13) | Documentation created |
|
Operating process/operating procedures Patch and vulnerability management (backup & recovery) (Annex A, 5.37, 8.8) | Documentation created |
|
Operating process/operating procedure for configuration management (Annex A, 8.9) | Documentation created |
|
Operating process/operating procedure for controlling external/outsourced development (Annex A 8.30) | Documentation created |
4. Documents
Work instructions and guidelines are a central component of your management system. We have already created the most important documents for you based on your specifications. Now it's time to adapt them to your specific requirements with the help of our AI.
|
Guideline for continuous improvement | Documentation created |
|
Guideline for changes in our management system | Documentation created |
|
Observing information security when creating websites and web applications | Documentation created |
|
Information security requirements for the creation of programme codes and algorithms | Documentation created |
|
Selection criteria for external service providers (information security) | Documentation created |
|
Procedure for the evaluation of external service providers | Documentation created |
|
Policy for registering new users in systems and assigning roles (identity management) | Documentation created |
|
Policy on the use and utilisation of mobile devices (smartphone, tablet) | Documentation created |
|
Guideline on information security for remote working (mobile working / home office) (Annex A, 6.7) | Documentation created |
|
Carrying out security checks on employees and partners (Annex A, 5.35, 6.1) | Documentation created |
|
Awareness and expertise in the area of information security | Documentation created |
|
Policy on the use of the Internet and the use of cloud services | Documentation created |
|
Directive on the handling of removable storage media | Documentation created |
|
Guideline for the creation and use of secure passwords | Documentation created |
|
Guideline: Web filtering and use of cryptographic measures (Annex A, 8.23, 8.24) | Documentation created |
|
Directive on the disposal of data carriers, equipment and storage media (Annex A, 7.10 and 7.14) | Documentation created |
|
Guideline for handling information security in supplier contracts (Annex A, 5.20) | Documentation created |
|
Assessment of information security at suppliers (Annex A, 5.19, 5.22) | Documentation created |
|
Guideline on Business Continuity Management (BCM) (Annex A, 5.29, 5.30) | Documentation created |
|
Guideline: Tidy working environment and screen locks (Annex A, 7.7) | Documentation created |
|
Guideline: Documentation and logging of activities, exceptions, errors and events (Annex A, 8.15) | Documentation created |
|
Guideline: Installation of software on systems in operation (Annex A, 8.19) | Documentation created |
|
Specification for the separation of development, test and production environments (Annex A, 8.31) | Documentation created |
|
Guideline for ensuring compliance with legal, statutory, regulatory and contractual requirements (Annex A, 5.31) | Documentation created |
5. Risks and opportunities
We have already created a list of risks in your certification tool. These are based on the information you provided in the questionnaire and the information on your activities. You can now edit and customise these risks and opportunities.
|
No or too slow response to security incidents | Documentation created |
|
Our goal: Ensure compliance with legal requirements and conditions | Documentation created |
|
Security risk: Data leaks from external services contain employee information | Documentation created |
6. Valuations
The ISO standards require an initial audit and an initial management review to be carried out as the basis for certification. We have already prepared and created both documents for you so that you are already optimally prepared for certification.
6.1. internal audit
As part of the establishment of our information security management system, we carried out a system audit to check conformity with the standard chapters of ISO 27001. We went through the requirements of the standard step by step and compared them with the implementation in our company.
This procedure enables us to determine the extent to which the specified standards for information security are complied with and where adjustments may be necessary. The result of this comprehensive review is set out in this first audit report, which documents both the strengths and potential for improvement of our information security management system.
Valuations / Management report
We have carried out an initial management review. We went through the requirements of chapter 9.3 of ISO 27001 step by step and checked the points listed there. This initial management review shows how our information security management system is currently implemented and what need for improvement has been recognised. The categorisation provides information on how the conclusions were drawn.
- Comprehensive analysis: We carried out a detailed assessment of the implementation of the security requirements, in particular with regard to the identified information security risks and their management.
- Performance review: We checked whether the measures introduced to improve information security were implemented effectively and achieved the desired results.
The results of this management review document both the strengths and the identified potential for improvement of our information security management system and serve as a basis for future measures to continuously improve information security.
|
1. Status of measures from previous management reviews | Documentation created |
|
2. Changes to internal and external information security management topics | Documentation created |
|
3. Deviations, errors and defects (so-called non-conformities) | Documentation created |
|
4. Results of our performance measurement | Documentation created |
|
5. Results of internal audits | Documentation created |
|
6. Fulfilment of our information security objectives | Documentation created |
|
7. Feedback from interest groups | Documentation created |
|
8. Changes in information security risks | Documentation created |
|
9. Opportunities for improvement | Documentation created |
Information Security
This document represents our first structured assessment of the information security of our independent activities. It looks at organisational as well as personal, technical and technological aspects of our working methods. The aim of this analysis is to make existing risks transparent and to create a comprehensible basis for the targeted improvement of our information security.
7. Declaration of principle
The ISO standards require that you, as a self-employed person or company management, commit to the principles of your management system. This also includes your employees. If you wish, you can also invite network partners or freelancers to also commit to the principles.
Teilen auf X
