The CONSUVATION GRC Platform is backed by experts who help shape ISO standards and audit as auditors for certification bodies. That is why the platform asks for exactly what the requirements demand and what is sensible and necessary, and nothing more. Small and mid-sized companies reach certification with lean documentation and without their own security department. And the result stands up in the audit.
Illustrative sample values. One implemented control counts towards every linked framework.
Software alone does not make a company audit-ready. Knowledge and experience make the difference: standards expertise from the ISO committees and more than 25 years of auditing and consulting. The platform is our tool; our experts support you across the entire cycle, from the initial project to ongoing operational support.
Our consultants sit on the ISO committees for ISO 27001 and ISO 27701. New editions of the standards are in the tool before others start interpreting them.
Controls, evidence requirements and audit questions come from our practice as auditors for certification bodies.
A shared control model links ISO standards, NIS2, GDPR and industry standards. One piece of evidence covers several requirements.
On request, we take on the role of external CISO or DPO and work directly in your platform, remotely or on site.
Many small and mid-sized companies need a certificate or have to comply with NIS2, but have neither a CISO nor a data protection team. The platform is built for exactly this situation, together with our operational support. Our experts create the documents, maintain risks and measures in the platform, handle the annual tasks and prepare you for the audit. You decide and approve. We do the work.
Germany’s NIS2 Implementation Act has applied since 6 December 2025. Software alone does not fulfil any of these obligations. Our experts and auditors implement NIS2 with you; the platform makes every step verifiable.
We assess your classification under § 28 BSIG and handle registration with the BSI, even though the deadline of 31 July 2026 has passed.
A proven NIS2 risk model and 64 NIS2 documents in 9 categories are ready to use. Our experts implement the measures with you.
Reporting process for 24 hours, 72 hours and one month under § 32 BSIG, plus the mandatory management training under § 38 BSIG.
External NIS2 officer, annual calendar and evidence for the BSI, customers and management, all available in the platform.
Standalone NIS2 solution for SMEs, without full ISO 27001 or TISAX. Obligations, deadlines, sectors, liability and fines in detail: nis2-richtlinie.de
Three questions, an instant result. The check is based on the German NIS2 Implementation Act and is not legal advice. Linked and partner enterprises count towards company size.
Answer the three questions. Your result will appear here.
NIS2 applies to you in full: registration, risk management under Art. 21, reporting obligations and personal accountability of senior management. Fines of up to €10 million or 2% of turnover are possible.
NIS2 applies to you: registration, risk management under Art. 21, reporting obligations and accountability of senior management. Fines of up to €7 million or 1.4% of turnover are possible.
For critical infrastructure (KRITIS) operators and certain digital services, NIS2 applies regardless of company size. We are happy to review the exact classification with you.
However, your customers must implement NIS2 in their supply chain and pass security requirements on to you by contract. An ISMS according to ISO 27001 is the usual way to demonstrate this.
We deliver more than a tool. In every phase, experts and auditors work with you, from the first project through certification to ongoing operations. The platform keeps everything together.
Determine the scope, applicability (for example under NIS2) and maturity level per framework.
ExpertsWe create documents, risks and measures with you directly in the platform.
ExpertsInternal audits and management review through the eyes of a certification auditor.
AuditorsAudit preparation, coordination with the certification body and support during the certification audit or TISAX assessment.
Experts and auditorsExternal CISO, DPO and AI Officer, annual calendar, legal monitoring, surveillance audits.
ExpertsA machine builder with a production network has different obligations from a software company or a research institute. That is why we start with your industry, not your company size.
No in-house security team, but customers demand ISO 27001 and NIS2 may apply to you.
Production plants, control systems and remote maintenance belong in scope, but do not fit classic IT catalogues.
OEMs require TISAX labels, often at short notice.
Several entities, sites and management systems need consistent governance and reporting.
Open networks, changing project teams and research data subject to funding requirements.
Data protection and security requirements differ by country and customer.
Clients demand classified information protection, VS-NfD-compliant IT and export control, often on top of ISO 27001.
Medical practices, care centres and hospitals process health data and must prove statutory IT security.
The Cyber Resilience Act applies to all products with digital elements on the EU market, including manufacturers outside the EU. Reporting obligations have applied since 11 September 2026, all obligations from 11 December 2027.
One management system for all sites, ISO 27001 as the baseline with country-specific standards, NIS2 in every EU country and for non-EU companies supplying Europe, and international legal monitoring.
All modules draw on the same assets, risks and evidence. Nothing is maintained twice.
Sites, assets, processes, risks and evidence are linked in one data model. You see at a glance what a change affects.
Creation, review, approval and versioning of all documents. Distribution follows need-to-know, with read confirmation.
Data protection and security incidents run through automated processes with the right reporting channels under GDPR, NIS2 and information security requirements. The platform calculates the reporting deadlines automatically.
Each asset carries its risk assessment, BCM parameters such as RTO and RPO, and the contingency plans.
No off-the-shelf courses. For every system we create tailored training, such as specific end-user training, exactly as auditors require. For awareness we use proven courses, for example on ransomware.
Employees see only the policies and processes they need for their work and confirm that they have read them. The read confirmation is your evidence in the audit.
Visitors are registered and documented per site directly in the platform, with no extra tool.
A supplier risk analysis by criticality sets the depth and frequency of reviews. The platform assesses suppliers automatically against the relevant standards and, if you wish, sends supplier questionnaires automatically.
Risk assessment is a core requirement of every management system standard and a key focus in audits. We have developed our own proven risk models and processes and built them into the platform.
Asset-based risk assessment with protection need, threats and vulnerabilities, aligned with ISO 27001 clauses 6.1 and 8.2.
Risk management measures for essential and important entities, demonstrable to the BSI and senior management.
Risk classification and impact assessment for AI systems, linked to the AI register and assets.
Risk-based supplier assessment with automatic questionnaires and fixed review cycles.
Our own risk model assesses how the use of AI endangers information security: 13 risk areas from shadow AI to in-house LLM applications and agents and AI in production, with 76 sample risks and 70 measures from 42 verified sources.
To the AI risk analysis →The result: implementation is much faster and audit-proof.
The platform comes with documentation landscapes that we built in client projects and proved in audits. Every document is typed as a policy, work instruction or evidence and is available in German and English. Further language versions exist.
Number of documents per library, each in German and English, other languages available. For the annual calendar: number of recurring tasks.
Both officer roles have fixed duties throughout the year. The platform schedules every task with a deadline, an owner and the evidence an auditor wants to see. Excerpt:
| Role | Q1 | Q2 | Q3 | Q4 |
|---|---|---|---|---|
| CISO | Update risk assessment, prepare management review | Internal audit, awareness campaign | Emergency drill, supplier evaluation | Review of the Statement of Applicability, audit planning |
| DPO | Activity report to senior management, RoPA review | Data protection training, review of TOMs | Review processors, deletion concept | DPIA review, annual planning |
Beyond the usual frameworks, we cover requirements from OT, the automotive industry, the defence industry and product regulation. For every framework, we advise on implementation and verify effectiveness as auditors.
Software alone does not make a company audit-ready. The difference lies in what stands behind the tool.
| Criterion | Typical SaaS compliance provider | CONSUVATION GRC Platform |
|---|---|---|
| Contribution to ISO 27001 and ISO 27701 | Implements published standards | ✓ Active members of the standardisation committees |
| Auditor perspective | Preparation for the audit | ✓ Auditors for certification bodies for ISO 27001, 27701, 22301, 9001 |
| OT, automotive and defence | Often not covered | ✓ IEC 62443, CADIS, TISAX with our own assessors, RED/RCE |
| External data protection officer | Mostly checklist-based | ✓ Standards-based according to ISO 27701 and SDM, with a law firm partnership |
| Cross-framework evidence | Depends on the product | ✓ One control model, evidence counts towards every framework |
| On-site implementation | Mainly remote | ✓ Remote and on site, dedicated contacts |
| Consultant qualifications | Often described vaguely as “certified” | ✓ Named openly: CISA, CISM, CRISC, CGEIT, auditor accreditations |
| Document libraries | Templates to fill in yourself | ✓ Audit-proven documentation landscapes in German, English and other languages |
| Solutions by industry | Segmented by company size | ✓ Dedicated packages for OT, automotive, critical infrastructure, research |
| Coordination with certification bodies | Your job | ✓ We handle it, thanks to close contacts with the certification bodies |
| Training | Often standard courses | ✓ Tailored end-user training per system, as required in audits |
| Access to policies | Often every document for everyone | ✓ Strictly need-to-know with read confirmation |
| AI support | You review AI results yourself | ✓ AI creates drafts, for example the RoPA and asset register, and experts review them |
| IT audit for the annual financial statements | Not part of the offering | ✓ IT auditors with CISA qualification |
The middle column describes offerings that are common in the market and does not refer to any specific provider.
This combination is rare in the market. It shapes how our platform is built.
We contribute to ISO 27001 and ISO 27701 and know the intent behind every requirement.
ISO 27001ISO 27701As auditors for certification bodies, we audit management systems. We also carry out our own audits under NIS2, GDPR, the AI Act, IEC 62443 and other frameworks. We know which evidence holds up.
Certification bodiesISO 22301ISO 9001CADISTISAXWe build management systems, take on CISO and DPO roles and support ongoing operations.
NIS2TISAXOTWe know audits as consultants and as auditors. That is why we know what matters and bring your management system to certification readiness quickly.
We maintain close contacts with certification bodies and handle the coordination for you.
Every package includes the platform. You decide how much expert support to add.
For SMEs with their own CISO or DPO
For SMEs without their own security department
For corporate groups, critical infrastructure and industry with OT
Every package includes full access to the platform. The packages differ in how much expert support is included.
Our consultants hold the internationally recognised ISACA certifications for audit, security, risk and governance.
Example: your documented and audited access control is stored once in the platform and linked automatically.
Checklists and guides from our project and audit practice.

“Knowing both sides of the audit means knowing the shortest route to certification.”
Peter Rentschler
Managing Director, CONSUVATION GmbH
We show you the platform using your target standard as the example and discuss the shortest route to certification for you.