ISO 27001: Build an ISMS and become ready for certification
An information security management system in accordance with ISO 27001 is the most frequently required proof in tenders, supply chains and regulation. NMS builds it, and is certified itself.
ISO 27001 · Microsoft Solution Partner
Customers require it in tenders, corporations in supplier evaluations, insurers in risk assessments: proof that information security is managed systematically. ISO 27001 is the internationally established standard for this, and, for many companies, the most pragmatic way to make security demonstrable.
What problem ISO 27001 solves
Most companies are already doing a lot for their IT security: firewalls, backups, antivirus protection, training. What is missing is proof that this is no coincidence, but a systematic approach: that risks are assessed, measures are prioritised, effectiveness is measured and deviations are corrected.
This is precisely what an information security management system (ISMS) provides. ISO 27001 outlines the requirements for this system, while Annex A provides a catalogue of concrete measures. Ultimately, the certificate serves as externally verifiable confirmation.
What an ISMS means for regulation
An ISMS according to ISO 27001 can be a suitable building block of evidence for regulatory requirements, for example, in the context of NIS2, KRITIS or requirements from the financial sector. Whether and to what extent a certificate is required or recognised in an individual case depends on the respective set of rules, the sector and the classification of the company, and must be examined on a case-by-case basis. The requirements are not identical: NIS2 adds, among other things, reporting obligations, supply chain requirements and the personal responsibility of executive management.
How NMS proceeds
- Gap analysis: Comparison of the current status with the requirements of the standard and the measures from Annex A. The result is a prioritised list of gaps with an estimate of effort.
- ISMS implementation: Scope, risk methodology, policies, roles and responsibilities, key metrics and review cycles, kept lean and tailored to the actual organisation.
- Technical implementation: Hardening of the Microsoft 365 and Azure environment, identity and access concept, logging, backup and recovery tests, endpoint protection: the measures that must be proven in the audit.
- Audit preparation: internal audit, management review, evidence file. NMS accompanies certification and surveillance audits.
- Operations: An ISMS thrives on repetition. As a Managed Service, NMS takes over monitoring, vulnerability management, awareness programmes and regular reviews.
Important distinction: NMS advises, builds and leads you to certification readiness. The certification itself is performed by an accredited certification body: this separation is required by standard specifications and is adhered to by us.
- Step 1 of 5Gap analysisComparison of the current status with the standard's requirements.
- Step 2 of 5ISMS setupScope, risk methodology, policies and responsibilities.
- Step 3 of 5Technical implementationHardening of Microsoft 365 and the infrastructure.
- Step 4 of 5Audit preparationInternal audit and management review before certification.
- Step 5 of 5OperationsAn ISMS relies on repetition: reviews, evidence, maturity.
Five steps in a fixed order: first know where you stand, then build, then prove.
Effort and duration
The effort required depends on the scope, locations, number of employees and maturity level. In practice, six to twelve months typically elapse between the gap analysis and certification readiness. The costs of the certification itself are charged by the certification body and must be considered separately from consultancy effort.
Why NMS
NMS is certified to ISO 27001 itself: we operate the very ISMS we talk about in-house. In addition, we hold Microsoft Solution Partner status for Modern Work, as well as ITIL-oriented service management for ongoing operations.
Legal notice: NMS provides technical and organisational IT consultancy, not legal advice within the meaning of the Legal Services Act (Rechtsdienstleistungsgesetz). The deadlines, thresholds and fine ranges mentioned here reflect the status of information as of the date specified and do not replace individual legal evaluation. Binding information is provided by the competent authorities (in particular the BSI) as well as specialised legal counsel. As of: July 2026
What is the difference between ISO 27001 and BSI IT-Grundschutz?
ISO 27001 is the international standard and describes requirements for the management system. BSI IT-Grundschutz is a German approach with very concrete building blocks and is frequently used by public authorities and KRITIS operators; it can be certified as "ISO 27001 based on IT-Grundschutz". Which path is suitable depends on customer requirements, sector and existing documentation.
How long does the path to ISO 27001 certification take?
In practice, it usually takes six to twelve months from the gap analysis to certification readiness. Crucial factors are the scope, maturity level of existing documentation and the availability of internal contact persons.
Is ISO 27001 sufficient to comply with NIS2?
ISO 27001 covers a large portion of the required risk management measures, but is not automatically synonymous with NIS2 compliance. In particular, reporting and registration obligations, supply chain requirements, as well as training and management obligations must be checked additionally.
Does NMS carry out the certification itself?
No. NMS advises, builds the ISMS and leads you to certification readiness. The certification audit is conducted by an accredited certification body: this separation is required by standard regulations. We support you with the selection and accompaniment of the body.
Solutions in a new dimension.
One conversation is enough to find out where IT, Microsoft Cloud and AI can take real weight off day-to-day business.
Your contact: Jan Emmerich, Managing Director