Information Security Management Strategy

ISO 27001 is an international standard with a risk-based approach — you define which controls are relevant. BSI IT-Grundschutz is more detailed and prescribes specific measures (building blocks). ISO 27001 is globally recognized and suitable for international organizations. BSI IT-Grundschutz is particularly prevalent in Germany, especially among KRITIS operators and public authorities. Both can be combined: an ISO 27001 certification based on IT-Grundschutz combines the advantages of both approaches.

The typical timeframe is 6–

12 months from project start to a successful Stage

2 audit. The duration depends on the current maturity level, the scope, and the available internal resources. Organizations with an existing management system (e.g., ISO 9001) can often achieve certification faster, as structures such as internal audit and management review are already established.

The pure certification costs (auditor fees) range from EUR 10,000–30,

000 depending on company size and scope. The larger investment block is preparation: internal resources, consulting, tool implementation, and training. A realistic total budget for a mid-sized company is EUR 50,000–150,000. ADVISORI helps deploy this budget efficiently and avoid overengineering.

NIS 2 does not mandate a specific framework, but requires systematic risk management, incident management, supply chain security, and governance structures — all core elements of an ISMS based on ISO 27001. In practice, an ISO 27001 certification is the most efficient way to demonstrate NIS 2 compliance. In addition, management bears personal responsibility for cybersecurity — another reason for a structured ISMS.

The key changes concern Annex A: instead of

114 controls in

14 groups, there are now

93 controls in

4 categories (organizational, people, physical, technological).

11 new controls have been introduced, including Threat Intelligence, Cloud Security, ICT Readiness for Business Continuity, and Data Masking. The transition deadline was

31 October

2025 — certifications based on the

2013 version are no longer valid.

TISAX (Trusted Information Security Assessment Exchange) is the information security standard of the automotive industry, based on the VDA ISA questionnaire. If you are a supplier or service provider for OEMs such as VW, BMW, or Mercedes, a TISAX assessment is generally a prerequisite for collaboration. TISAX and ISO 27001 have significant overlaps — an existing ISMS considerably facilitates TISAX readiness.