ISMS Software
for ISO 27001

ISO/IEC 27001 is the internationally recognised standard for information security management systems (ISMS). It defines how an organisation plans, implements, monitors and improves information security systematically — with risk assessment at its core and the 93 controls of Annex A as its catalogue of measures; ISO/IEC 27002:2022 gives implementation guidance for them. The current edition is ISO/IEC 27001:2022.

ISMS software maps the components of an information security management system in one data model — scope, assets, requirements, risks, controls and evidence — and links them to each other. Instead of keeping spreadsheets and documents consistent by hand, you maintain every object once, and reports such as the Statement of Applicability are generated from the data.

At least: the requirements of ISO/IEC 27001:2022 and the Annex A controls with implementation status, an asset structure with dependencies, risk analysis and risk treatment with a configurable risk matrix, measures with owners and deadlines, evidence on the object, the Statement of Applicability, reports for management review and audit — and interfaces to the systems where your assets and tasks already live.

Yes. The requirements of ISO/IEC 27001:2022 and the 93 Annex A controls of the standard are included as a catalogue — with implementation guidance from ISO/IEC 27002:2022 — and are assessed on your asset tree. When a new edition of the standard appears, the catalogue is updated; existing assessments and evidence migrate with it.

Yes. The SoA is built on the basis of the requirements and controls: for every control, applicability, justification and implementation status are documented, and the report is generated from that — at the initial audit and before every surveillance audit, without rewriting the statement.

Threats are identified per asset — from standard or your own threat catalogues — and assessed in a configurable risk matrix. For every risk, the treatment option and measures are set; gross and residual risk can be tracked over time, and the risk treatment plan is generated as a report.

Yes — as guidance, not as a certification standard: ISO/IEC 27005 describes the information security risk management process that ISO/IEC 27001 requires. Complaica maps that process: risks are identified, analysed and evaluated per asset, for every risk the treatment option, controls and measures are set, and the residual risk stays linked to asset, risk and evidence. There is no certification against ISO/IEC 27005; the results feed the risk treatment plan and the SoA for the ISO 27001 audit.

Yes. Complaica imports and exports data from and to Excel, over the REST API and from other ISMS tools; migrating your data is free and accompanied by our specialists. So you evaluate the tool on your own data set rather than on demo data.

Yes. TISAX, BSI IT-Grundschutz, NIS2, GDPR, ISO 22301 and further standards are assessed on the same scope model and use the same assets, risks, measures and evidence. What is documented for ISO 27001 counts for the other standards too.

Yes, both. The SaaS variant is hosted in Germany; on-premises you run Complaica in your own infrastructure. The licence costs the same either way.

Over the REST API, asset management and CMDB systems such as i-doit, GLPI, FNT Command and others, as well as Jira, SAP and Microsoft Azure. Application data is available through data marts for external analysis and reporting systems, and an AI assistant can be connected over MCP.

Evidence sits on the object it proves, and the reports — SoA, risk treatment plan, implementation status — are generated from the current data set. Dashboards show the state before the audit, and external auditors can be given targeted access. Because the same data set keeps running, surveillance audits and the recertification after three years are prepared out of ongoing operation. The certification itself is performed by an independent certification body.

For any organisation that processes confidential information and wants to prove it to customers, partners or regulators — regardless of size and industry. It is especially common among IT and cloud service providers, suppliers to regulated industries, operators of critical infrastructure and companies facing NIS2 or TISAX: an ISMS according to ISO 27001 covers a large part of those requirements too.

It is not required by law. In practice it becomes mandatory through contracts and tenders — many customers demand the certificate as proof — and indirectly through regulations such as NIS2, KRITIS or DORA that require an ISMS; ISO 27001 is the usual way to run that ISMS demonstrably.

The costs have three parts: the effort for setting up and running the ISMS (internal time, consulting, software), the certification audit by an accredited body and the annual surveillance audits. They depend above all on the size of the scope, the number of sites and the maturity of your existing processes. Complaica lowers the first part: the prepared content, the evidence generated from the data and the AI integration save most of the documentation work. We send you a price list on request.

Typically three to twelve months from start to certificate — depending on scope, existing documentation and available resources. With prepared content and consulting, smaller organisations sit at the lower end. The certificate is valid for three years, with annual surveillance audits and recertification afterwards — Complaica keeps the data set current throughout.