Theme 5
Organisational Controls
Information security policies, roles & responsibilities, threat intelligence, information security in projects, cloud usage, business continuity and more.
37 ControlsCONSUVATION GmbH guides you from the first step through to certification according to ISO/IEC 27001:2022 – and beyond. With more than 25 years of ISMS experience, our own correlation matrix, and 100% senior consultants. For the DACH region and international clients.
Quick Check
Find out in 30 seconds whether and why ISO 27001 is relevant for your company – free & without registration.
At a Glance
ISO/IEC 27001 is the world's leading standard for information security management systems (ISMS). It defines how companies systematically manage, monitor and continually improve information security.
The current version ISO 27001:2022 introduces 93 controls across 4 themes (instead of 114 in 14 categories) and new focus areas such as cloud security, threat intelligence and data masking.
ISO 27001 is the foundation for all other standards – TISAX, CADIS, NIS2 and IEC 62443 build upon it or reference it directly.
Our consultants were among the first certified BS 7799 auditors in Germany – the direct precursor to ISO 27001. This foundational expertise combined with current practice makes us one of the most experienced ISO 27001 consulting firms in the DACH region.
ISO 27001:2022 – Annex A
ISO 27001:2022 fundamentally revised the controls. Instead of 114 controls in 14 categories, there are now 93 controls across 4 clearly structured themes – including 11 new controls.
Theme 5
Information security policies, roles & responsibilities, threat intelligence, information security in projects, cloud usage, business continuity and more.
37 ControlsTheme 6
Screening of employees, information security awareness, training, disciplinary processes, confidentiality agreements and remote working.
8 ControlsTheme 7
Physical security perimeters, offices & facilities, physical security monitoring, protection against physical threats, working in secure areas, clear desk & screen.
14 ControlsTheme 8
Endpoint security, privileged access, cryptography, secure software development, data masking, data leakage prevention, monitoring, web filtering and more – including all new controls.
34 ControlsOur Approach
Structured, predictable and without surprises – our proven approach guides you reliably to ISO 27001 certification.
01
Free initial consultation, defining the scope, identifying stakeholders, creating a project plan.
02
Current-state assessment, comparison with ISO 27001:2022 requirements, identifying gaps, prioritising a measures plan.
03
Implementing policies, processes and controls. Risk analysis, Statement of Applicability, documentation.
04
Conducting an internal audit, management review, resolving nonconformities, checking audit readiness.
05
Stage 1 & Stage 2 audit by an accredited certification body, supported by CONSUVATION consultants.
06
Ongoing operation of the ISMS, support for surveillance audits, ensuring continuous improvement.
ISO 27001 & Other Standards
ISO 27001 is the foundation – all other relevant standards build upon it or reference it directly. Companies that already have ISO 27001 have completed most of the work.
TISAX is based directly on ISO 27001 Annex A. Companies that already have ISO 27001 reach TISAX with significantly less effort. TISAX ISA now also covers OT availability of production facilities.
IEC 62443 specialises ISO 27001 for industrial control systems (OT). Implemented together, they create a complete ISMS with technical OT depth for SCADA, PLCs and DCS.
CADIS Module 1 is based entirely on ISO 27001. Companies certified to ISO 27001 have already fulfilled the most important CADIS module. CONSUVATION guides you through both standards in a single project.
NIS2 requires appropriate cybersecurity measures – without prescribing specific tools. ISO 27001 is the internationally recognised evidence of NIS2 compliance and is considered "best practice".
ISO 27001 directly addresses the technical and organisational measures required under Art. 32 GDPR. An ISO 27001 ISMS provides evidence of appropriate data security to supervisory authorities.
BSI IT-Grundschutz and ISO 27001 are aligned with one another. Many authorities and critical infrastructure operators combine both frameworks. CONSUVATION is familiar with both approaches and integrates them efficiently.
ISO 27001 requires a risk assessment but does not prescribe a methodology. ISO 27005 provides exactly that – tailored specifically to information security and, in its current 2022 edition, closely aligned with the terminology and risk framework of ISO 31000. It is the methodological link between the ISMS requirement and generic risk management.
Core Requirements
ISO 27001 is a management system – it's not just about technology, but about processes, people and organisation.
Identify internal & external issues, define the scope, understand stakeholders and their requirements.
Identify, assess and treat information security risks. Create and maintain a Statement of Applicability (SoA). Methodologically, we rely on ISO 27005 – aligned with the risk framework of ISO 31000.
Provide resources, ensure competence, create awareness, regulate communication and maintain ISMS documentation.
Measure ISMS performance, conduct internal audits, hold management reviews and evaluate metrics.
Resolve nonconformities, implement corrective actions and systematically develop the ISMS further.
Select the relevant controls from 93 options, justify them in the SoA and implement them verifiably – both technically and organisationally.
Implementation Checklist
Services
From gap analysis to certification support – everything from a single source, with senior consultants and our own correlation matrix.
01
Systematic comparison of current state vs. target state against ISO/IEC 27001:2022: what exists, what's missing, what needs to be prioritised – clearly documented with a measures plan.
02
Complete ISMS build-up according to ISO 27001: policies, processes, risk assessment, Statement of Applicability, control implementation and documentation.
03
Preparation for Stage 1 and Stage 2 audits: pre-audit, closing gaps, document review and support during the certification audit.
04
Transitioning from ISO 27001:2013 to 2022: delta analysis, integrating new controls, updating the SoA – for companies with existing certification.
05
Conducting internal audits according to ISO 19011, management review preparation, nonconformity management and continual improvement documentation.
06
ISO 27001 as the foundation for all other standards: NIS2, TISAX ISA, CADIS, IEC 62443 and BSI Grundschutz in one integrated ISMS project – maximum synergies.
07
ISO 27001 training for all levels: basics for employees, ISMS training for information security officers, management briefings, and executive training for NIS2 (§ 38 BSIG).
08
Ongoing support for ISMS operations: surveillance audit support, policy updates, risk reviews and continual improvement.
Frequently Asked Questions
Our ISO 27001 Solutions
Project plan, process models, training portal, dashboard and an external information security officer – all from a single source. Scalable for small, mid-sized and large companies.
The 5 Building Blocks of Our Complete ISO 27001 Solution
ISO 27001 Management System
Foundation & Governance
Process Model & Policies
All 93 Controls
Training Portal
DE & EN, with Test
ISMS Dashboard
Operations & Governance
External ISO
Remote + Optional On-Site
Entry-level solution for small companies. Includes all essential building blocks for an initial ISO 27001 certification – pragmatic, fast and cost-efficient.
Complete ISO 27001 solution for mid-sized companies – including training portal, dashboard and an external information security officer on demand.
Maximum solution for complex organisations – with an individual project structure plan, on-site support and integration with TISAX, CADIS or NIS2.
All packages include an individual project plan and are tailored to your company. Remote support included – on-site appointments available on request. Schedule a consultation now →
Our Expertise
CONSUVATION exclusively employs senior consultants. With more than 25 years of experience in information security, we are one of the most experienced ISO 27001 consulting firms in the DACH region.
Our experts were among the first certified BS 7799 auditors – the direct precursor to today's ISO 27001. They combine this foundational expertise with current practical experience in ISO 27001:2022, TISAX ISA, CADIS and NIS2.
As active ISO working group members, we bring insider knowledge that flows directly into your ISMS implementation.
Our Tool: ISO 27001 Correlation Matrix
CONSUVATION has developed its own correlation matrix for ISO 27001 requirements, which maps all relevant standards – ISO 27001, IEC 62443, TISAX ISA, CADIS, NIS2 and BSI Grundschutz. This allows us to identify synergies immediately and create a complete gap analysis in the shortest possible time – without duplicate work and with maximum standards coverage.
Certified consultants & auditors – from gap analysis through to certification audit support
The most renowned ISACA certifications – from IT audit to IT governance and risk management
Integrated ISMS implementation for all standards built upon ISO 27001 – in one project, without duplicate work
Over 25 years of experience since the beginnings of BS 7799 – the precursor to ISO 27001
Get Started Now
Get advice from an experienced CONSUVATION consultant – free, no obligation, and no generic boilerplate.