ISO 27001: Build an ISMS and become ready for certification
An information security management system in accordance with ISO 27001 is the most frequently required proof in tenders, supply chains and regulation. NMS builds it, and is certified itself.
ISO 27001 · Microsoft Solutions Partner
Customers require it in tenders, corporations in supplier evaluations, insurers in risk assessments: proof that information security is managed systematically. ISO 27001 is the internationally established standard for this, and, for many companies, the most pragmatic way to make security demonstrable.
What problem ISO 27001 solves
Most companies are already doing a lot for their IT security: firewalls, backups, antivirus protection, training. What is missing is proof that this is no coincidence, but a systematic approach: that risks are assessed, measures are prioritised, effectiveness is measured and deviations are corrected.
This is precisely what an information security management system (ISMS) provides. ISO 27001 outlines the requirements for this system, while Annex A provides a catalogue of concrete measures. Ultimately, the certificate serves as externally verifiable confirmation.
What an ISMS means for regulation
An ISMS according to ISO 27001 can be a suitable building block of evidence for regulatory requirements, for example, in the context of NIS2, KRITIS or requirements from the financial sector. Whether and to what extent a certificate is required or recognised in an individual case depends on the respective set of rules, the sector and the classification of the company, and must be examined on a case-by-case basis. The requirements are not identical: NIS2 adds, among other things, reporting obligations, supply chain requirements and the personal responsibility of executive management.
How NMS proceeds
- Gap analysis: Comparison of the current status with the requirements of the standard and the measures from Annex A. The result is a prioritised list of gaps with an estimate of effort.
- ISMS implementation: Scope, risk methodology, policies, roles and responsibilities, key metrics and review cycles, kept lean and tailored to the actual organisation.
- Technical implementation: Hardening of the Microsoft 365 and Azure environment, identity and access concept, logging, backup and recovery tests, endpoint protection: the measures that must be proven in the audit.
- Audit preparation: internal audit, management review, evidence file. NMS accompanies certification and surveillance audits.
- Operations: An ISMS thrives on repetition. As a Managed Service, NMS takes over monitoring, vulnerability management, awareness programmes and regular reviews.
Important distinction: NMS advises, builds and leads you to certification readiness. The certification itself is performed by an accredited certification body: this separation is required by standard specifications and is adhered to by us.
- Step 1 of 5Gap analysisComparison of the current status with the standard's requirements.
- Step 2 of 5ISMS setupScope, risk methodology, policies and responsibilities.
- Step 3 of 5Technical implementationHardening of Microsoft 365 and the infrastructure.
- Step 4 of 5Audit preparationInternal audit and management review before certification.
- Step 5 of 5OperationsAn ISMS relies on repetition: reviews, evidence, maturity.
Five steps in a fixed order: first know where you stand, then build, then prove.
Effort and duration
The effort required depends on the scope, locations, number of employees and maturity level. In practice, six to twelve months typically elapse between the gap analysis and certification readiness. The costs of the certification itself are charged by the certification body and must be considered separately from consultancy effort.
What do we run the ISMS with?
What do we run the ISMS with?
With whatever suits your size. An ISMS is a set of rules, records and repetitions: it can be run on spreadsheets, on a dedicated tool, or on something in between. That decision is made early and is expensive to reverse.
Three approaches we see in projects:
Spreadsheets and documents: cheap, available immediately, and unmanageable beyond roughly 30 controls. The effort sits in maintenance, not in purchase.
A dedicated ISMS tool: keeps controls, risks, records and deadlines in one place, reminds you of recurring tasks and produces the reports for the audit. Costs licence and training.
Extending existing tools: if you already run a ticket system or Microsoft 365, parts can live there. Saves licences but demands discipline about structure.
How do you recognise the right tool?
How do you recognise the right tool?
Not by its feature list but by whether it is actually used day to day. An ISMS that is only maintained before an audit shows at the first surveillance audit.
How many people will maintain it? For three people, a large tool is ballast.
Is there already a certification in the house you can build on?
Does it produce evidence in the form an auditor accepts, or must it be rebuilt?
What happens at a standards revision? ISO 27001 was revised in 2022; the next one will come.
Who operates it, and what does that cost over three years, not over one.
We go through the selection with you before you commit, and we will say so if spreadsheets are enough for your size. A recommendation without knowing your situation would be selling, not advising, which is why there is no product ranking here.
What does the journey to certification look like?
What does the journey to certification look like?
Typically nine to eighteen months, depending on how much is already documented. The sequence is the same in every project:
Take stock and define the scope: what belongs in the ISMS and what does not
Gap analysis against Annex A of the standard, with an honest assessment rather than a wish list
Implement controls, write policies, name those responsible
Internal audit and management review: the standard requires both
Certification audit in two stages by an accredited body
Afterwards: annual surveillance audits, recertification every three years
The certificate is issued by an accredited certification body, not by us. Our work ends where the auditor begins, and starts again at the next surveillance audit. Operators of critical infrastructure additionally need evidence under the German BSI Act; more on our page about KRITIS consulting.
Why NMS
NMS is certified to ISO 27001 itself: we operate the very ISMS we talk about in-house. In addition, we hold Microsoft Solution Partner status for Modern Work, as well as ITIL-oriented service management for ongoing operations.
Legal notice: NMS provides technical and organisational IT consultancy, not legal advice within the meaning of the Legal Services Act (Rechtsdienstleistungsgesetz). The deadlines, thresholds and fine ranges mentioned here reflect the status of information as of the date specified and do not replace individual legal evaluation. Binding information is provided by the competent authorities (in particular the BSI) as well as specialised legal counsel. As of: July 2026
What is the difference between ISO 27001 and BSI IT-Grundschutz?
ISO 27001 is the international standard and describes requirements for the management system. BSI IT-Grundschutz is a German approach with very concrete building blocks and is frequently used by public authorities and KRITIS operators; it can be certified as "ISO 27001 based on IT-Grundschutz". Which path is suitable depends on customer requirements, sector and existing documentation.
How long does the path to ISO 27001 certification take?
In practice, it usually takes six to twelve months from the gap analysis to certification readiness. Crucial factors are the scope, maturity level of existing documentation and the availability of internal contact persons.
Is ISO 27001 sufficient to comply with NIS2?
ISO 27001 covers a large portion of the required risk management measures, but is not automatically synonymous with NIS2 compliance. In particular, reporting and registration obligations, supply chain requirements, as well as training and management obligations must be checked additionally.
Does NMS carry out the certification itself?
No. NMS advises, builds the ISMS and leads you to certification readiness. The certification audit is conducted by an accredited certification body: this separation is required by standard regulations. We support you with the selection and accompaniment of the body.
Solutions in a new dimension.
One conversation is enough to find out where IT, Microsoft Cloud and AI can take real weight off day-to-day business.
Your contact: Jan Emmerich, Managing Director