How to find the best ISMS tool

Guide: Everything you need to know when selecting ISMS software.

With detailed Excel criteria catalog, market overview and tool reviews.

1 How does an ISMS according to ISO/IEC 27001 work?

2 What are the functions of ISMS software?

3 What are the differences between the tools on the market?

2 Does it also work with Excel?

5 How do I find the right software for me? The tender

6 Excel requirements catalog

7 Market overview

8 Tool reviews

9 Other resources

An ISMS (Information Security Management System) is a management system that systematically ensures and improves information security in an organization by means of a large number of coordinated measures. The starting point is the protection requirements of the business processes that are relevant for the scope under consideration. For example, an HR process such as payroll accounting has higher data confidentiality requirements than the ordering process for office supplies.

The business processes are linked to the assets they use, which is, for example, the IT application through which a process is handled. This means that the HR application, for example, and therefore also the HR server and server room, must meet higher confidentiality requirements.

It is now assessed which threats are relevant for an asset. For the HR application, this could be the possibility of guessing passwords, and for the server room, the threat of fire. This allows the identification of the the relevant risks to which the assets are exposed.

Each risk is assessed in terms of probability of occurrence and impact, resulting in the important areas for action. The risk treatment then determines how the risk is to be addressed. For example, it can be accepted or reduced through appropriate measures.

The appropriate measures are derived from controls that are part of the relevant standards. One control, for example, can be the existence of a password management system that enforces sufficiently complex and thus difficult-to-guess passwords.

This results in extensive measures to ensure information security. These can be instructions/directives, processes, and tools that must be introduced and whose effectiveness must be regularly reviewed.

From the previous description, it is clear that complex structures consisting of business processes, assets, threats, vulnerabilities, risks, measures and tasks arise and have to be processed in an information security management system. Even in small organizations, these structures can only be mapped and kept consistent with difficulty in Excel spreadsheets. Therefore, it makes sense to use specialized programs that guide through the structures and ensure consistency.

Many tools work according to this scheme ... Explanations below the graphic.

A typical ISMS software has many of the following functions and features:

Scope

• Define scope
• Management of interface requirements

Business processes

• Assessment of the impact in case of violation of the protection goals
• Inheritance of the protection requirements along the asset links
• Calculation of protection needs for an asset in case of multiple incoming streams and possibility of manual overwriting

Assets

• Setup of an asset register
• Categorization and documentation of assets
• Linking of assets to map usage relationships

Protection needs of the assets

• Linking business processes to assets
• Inheritance of protection requirements to the assets
• Offsetting of protection needs for an asset in case of multiple incoming streams and possibility of manual overwriting

Risk assessment

• User interfaces for assigning threats to assets and for evaluating them in terms of impact and probability of occurrence
• Ability to analyze at different points in time
• Included content: Hazard catalogs with threats and vulnerabilities

Risk treatment

• Determination of the risk strategy
• Definition of measures
• Assessment of the residual risk
• Possibility of analysis at different points in time
• Included content: Controls, e.g. Annex A of ISO 27001

Task management

• Defining tasks
• Assignment of responsibilities
• Planning of costs and efforts
• Tracking of progress or implementation

Document control

• Storing and/or linking documents for policies, etc.
• Approval process
• Resubmission process

Audit and review support

• Planning of audits and reviews
• Determination of the subject areas
• Documentation of results

Reporting

• Statement of Applicability (SoA)
• Risk Treatment Plan
• Measures with implementation status
• IT inventory
• KPI

Other functionalities

• Dashboards
• Functions for decentralized data acquisition
• Master data management

Optional modules

• Data Privacy Management
• Business Continuity Management
• IT Risk Management
• IT Service Continuity Management / IT Emergency Planning
• Enterprise Risk Management

Technical functionalities

• Multi-client capability
• Authorization system
• Data export / import
• Interfaces
• E-mail notification
• LDAP/Active Directory connection
• Single Sign On (SSO)

Due to the orientation on standards such as ISO 27001, the basic functionality of ISMS software products is similar. Nevertheless, the tools can differ significantly from each other, as the providers have different approaches and set their own priorities.

Some aspects are listed below:

• Installation in your own data center (on-premises) or use as a cloud service (Software as a Service - SaaS).
• Native client or web interface?
• Is a special platform required? (e.g. Confluence, MS Sharepoint)
• Included content (threat catalogs, standards and controls)
• Level of configurability
• Level of customizability (consider release compatibility)
• Specific functions (e.g. calculation of the resulting protection requirement, gross or net risk assessment)
• Group suitability (e.g. decentralized asset recording and BIA, authorization system)
• Automation options
• Interfaces
• Available add-on modules

One should not proceed blindly according to the motto "a lot helps a lot", because more functions can possibly make use and operation more complicated. Instead, you should determine what is actually needed in your own organization, and of course also take a look into the future and derive your concrete requirements for a tool from this.

Is special software required for an ISMS or can the structures also be set up with Excel? Yes, in simple cases it also works with an Excel spreadsheet. After all, each structural element in itself is a list that can be packed perfectly into an Excel worksheet, for example the asset inventory. However, the difficulties arise at the points where you have to link the individual elements together, starting with the relationships between the assets. Here, a spreadsheet offers only limited possibilities to maintain the consistency of the data, which must be compensated by the user through diligence and discipline. This is still acceptable in simple cases, but with extensive structures it quickly becomes a Sisyphean task.

This also becomes clear when looking at the diagram at the top of this page: The assets alone are linear and can be wonderfully mapped in a spreadsheet

The final structure, however, consists of several interlinked data structures, manual maintenance and consistency maintenance of the data becomes very costly:

In addition, there is the rigid layout of rows and columns, which is impractical when merging multiple structural elements. The assets themselves can be perfectly arranged in a table. But if the risks are to be listed under each asset and the controls as well, then it quickly becomes confusing, either because a column has to be used for different contents and these are all displayed in the same width, which often does not fit. Or because the substructures are moved so far to the side that you permanently have to scroll horizontally.

Everything is somehow feasible, but above a certain size, the user must have a high tolerance for pain. The logical conclusion: tools are needed which keep the data consistent and which, at the same time, have expedient interfaces for conveniently capturing and linking the data → That is exactly what ISMS tools are. In addition to these basic functions, however, the applications also bring numerous other capabilities, which will be discussed in the next chapter.

This guide provides step-by-step instructions for tool selection. It describes a basic procedure with project initiation, project planning, general concept, tender, selection and decision, which you can adapt to your situation.

Our guide covers the following points:

• Project initiation
• Definition of requirements
• Tool selection and contract agreement

This includes points like:

• Clarify current status and problems
• Describe solution approach
• Developing benefits for the organization
• Clarify basic willingness and ability to carry out such a project
• Clarify goals and scope
• Perform initial market screening
• Define target state
• Putting together a rough concept
• Create project plan
• Review
• Prepare a decision and submit it for approval

To find the ISMS software that best suits your needs, you should first work out the general conditions of your organization and the general requirements for such a tool. This will lead you to important considerations, the extract will flow into the criteria and test catalogs you will use in tje selection process.

This includes tasks like:

• Create Longlist
• Planning of process
• Obtain information from product suppliers
• Supplier presentations
• Create Shortlist
• Proof of concept
• Trial version
• Narrow down suppliers
• Offer presentations
• Negotiations
• Decision & approval for procurement and tool introduction
• Contract conclusion

In order to compare different vendors and their products, a catalog of requirements in Excel is often useful. This is created by the searching organization and sent to the vendors with a request for response. A detailed template with pre-filled criteria can be found on the linked page. However, you should tailor the catalog to your specific requirements before using it.

Overview of products:
Market Overview ISMS Software

ISMS Open-Source-Tools:
ISMS open-source tools

Here you can find test reports on selected tools: