ISMS: Excel, Confluence or a specific software?

Does it really have to be special software to build an ISMS or are tools like MS Excel or Confluence sufficient? It depends on your requirements and general conditions.

An ISMS has a lot to do with structured data and documents, so the use of office tools with spreadsheets and text programs such as Microsoft Excel and Word seems to offer a quick solution. This is certainly possible for simple structures and a small amount of data. However, an essential element of an ISMS is also a manifold linking of data, documents and tasks - and in the case of Office, these links have to be created manually and kept up to date. This can quickly become a big and annoying diligence to keep everything consistent. Therefore: Yes, office software is possible if it is limited to simple structures and you have a certain tolerance for pain.

Systems like Confluence allow for more structures that help manage the ISMS. With the basic system you already have a storage location for documents with categorization, versioning and authorization system, can define templates for different document types, has a task management and much more. It is therefore easier to keep the contents consistent. It is even easier if a third party provider has already prepared such a system, provides suitable templates, etc. Such a system can be useful for medium requirements, especially if the collaboration platform is already used in the organization.

However, since such systems are strongly document-centered, they can reach their limits if the structured part is extensive or complex. For example, when extensive asset structures need to be mapped, complex organizational hierarchies are to be authorized, mass changes are required, complex interfaces must be implemented, or if an existing document management system is to be integrated to manage guidelines. In addition, care should be taken not to end up in "add-on hell", i.e. to use add-ons from different providers that have different update cycles, need to be checked for compatibility again and again, etc.

Tools that are specifically designed to manage an ISMS often have their strengths in the structured part. This makes them particularly suitable for mapping complex organizational and asset structures, implementing interfaces and integrating other tools. A further advantage is that often not only one standard such as ISO 27001 is supported, but that others such as PCI-DSS or HIPAA can also be mapped.