Blog
What supervisory authorities check and what audits ask for.
The articles come out of daily work on ISMS, BCMS, DSMS and AIMS, from the first scope check through evidence for measures to the audit itself.
27 articles
- 29 October 2026
ISO 27001 Audit Prep: What Does the Auditor Check?
What the auditor checks in Stage 1 and Stage 2, which evidence should be ready beforehand and how to handle major and minor nonconformities, backed by ISO/IEC 17021-1 and accreditation requirements.
20 min readRead - 27 October 2026
BSI 300-1 vs. 200-1: What Grundschutz++ Changes
BSI Standard 300-1 puts the Grundschutz++ methodology into five process steps. What changes from 200-1, 200-2 and 200-3, and why OSCAL matters.
10 min readRead - 22 October 2026
PHP2Shell: Who is affected and what to do now
Two critical PHP flaws allow code execution without login. What the BSI has documented, which versions protect you and what organisations should check now.
18 min readRead - 14 October 2026
ISMS Software Requirements Catalogue: What Goes In?
How to write a requirements catalogue for ISMS and GRC software that is product-neutral, testable and procurement-proof: structure, mandatory and scored criteria, ISO 27001 and IT-Grundschutz, operations, vendor security, EVB-IT and common mistakes.
21 min readRead - 9 October 2026
Elias Nassall: This Can Be Done Better
Five years of Big Four consulting and one thought on repeat: this can be done better. Elias Nassall explains why he is building at KaitoSec the solution he wanted on every project, and what resilience means to him.
5 min readRead - 9 October 2026
Chris Müller: Taking a Wrong Turn into Cybersecurity
From aspiring social worker to Big Four consulting to CEO of KaitoSec: Chris Müller on why he wants to make information security easier and what resilience means to him.
10 min readRead - 7 October 2026
Cyberattack on the City of Vienna: 26,000 documents taken, discovered through a sales listing
26,000 documents were copied from an internal City of Vienna platform, discovered through a sales listing. What is documented and what others can check now.
14 min readRead - 1 October 2026
Tracking ISMS Measures: Status, Evidence, Roles
An implemented measure is not yet an effective one. This guide combines a status model, evidence ageing, roles and deadlines from the BSI standards, ISO 27001 and the BSIG into one working model.
19 min readRead - 27 September 2026
Risk Assessment under ISO 27005: Method, Criteria, Evidence
ISO/IEC 27005 doesn't prescribe a scale, but it does require four phases on the way to a treatment decision. This guide brings together the criteria, the BSI-Standard 200-3 example matrix, and the documentation you need as audit evidence.
17 min readRead - 18 September 2026
ISMS without a security team: roles, effort, tools
BSI IT-Grundschutz requires at least one appointed person, not a team. This guide pulls the roles, duties and sources from ISO 27001, the BSI-Standards and the BSIG together into one matrix.
18 min readRead - 17 September 2026
Management liability under § 38 BSIG: Risks beyond fines
§ 38 BSIG requires management to implement measures, oversee them and attend training. Understand liability to the entity, fines and supervisory action.
6 min readRead - 10 September 2026
What Does ISMS Software Cost? Pricing Models Compared
The license fee is only one of six cost blocks. This article sorts the DACH market into three price tiers and shows what comes on top for rollout, internal effort, training, and operation.
20 min readRead - 5 September 2026
Extortion Demand: Who Decides, and by What Criteria?
When ransomware hits, the payment decision formally belongs to management, not IT, but it hinges on sanctions checks, insurance terms, and forensic findings a crisis team prepares. Here is who decides, what criteria matter, and why a payment can itself be illegal.
17 min readRead - 29 August 2026
What does ISO 27001 certification cost for a mid-sized company?
Auditor days are tied to accreditation and are not negotiable, the day rate is. Market ranges for the audit, consulting and internal effort.
16 min readRead - 24 August 2026
Cyberattack on a small power plant in the United Kingdom: four days of downtime below the reporting threshold
A small power plant in the United Kingdom went offline for four days after a cyberattack in July 2026, but the case only became public four weeks later. What is documented, what is reconstructed, and which reporting duties would apply in Germany since December 2025.
13 min readRead - 21 August 2026
KRITIS-Dachgesetz and NIS2: What Applies to Whom?
KRITIS-Dachgesetz and NIS2 apply in parallel: physical resilience falls under the BBK, cybersecurity under the BSI. Thresholds, deadlines, and fines at a glance.
13 min readRead - 19 August 2026
The cyberattack on Berlin's state network: seven days undetected, five days of data outflow
Attackers were undetected in Berlin's state network for seven days. What is documented, who bears the damage once operations resume, and what other organisations can check for themselves.
20 min readRead - 13 August 2026
Grundschutz++ from 2027: certifiable, but how mature?
Grundschutz++ becomes certifiable on 1 January 2027. The methodology breaks with the old BSI IT-Grundschutz, but the risk assessment remains open.
13 min readRead - 5 August 2026
Resilience Made Easy: The Path from GRC Filing Cabinet to Agentic Workspace
Why we're not building KaitoSec as a GRC filing system, but as an agentic workspace for continuous resilience, and what that means for the information security officer's daily work.
9 min readRead - 11 May 2026
Do I Need an ISMS for NIS2? Mandatory or Optional
NIS2 does not require an ISMS or ISO 27001 certification. What the BSI actually demands, which structures §30 BSIG requires, and what SMEs need to know.
13 min readRead - 27 April 2026
NIS2 Incident Reporting: When, What, and to Whom?
Three-stage NIS2 reporting: early warning (24h), initial notification (72h), final report (1 month). Who reports what to whom, and what fines apply for violations?
14 min readRead - 8 April 2026
Is ISO 27001 Enough for NIS2 Compliance?
No, says the BSI. ISO 27001 is a solid foundation, but scope freedom, risk acceptance, and §32/§38 BSIG duties remain open. How to close the gaps.
12 min readRead - 25 March 2026
Am I Affected by NIS2? How to Check
Whether your company falls under NIS2 depends on sector and company size. 18 sectors, size thresholds and special cases, explained step by step.
14 min readRead - 21 March 2026
NIS2 Consultant or DIY? A Cost Comparison
An NIS2 consulting project costs SMEs EUR 50,000–150,000. Which parts you can handle yourself, where a consultant pays off, and how the hybrid approach works, with concrete numbers.
11 min readRead - 19 March 2026
NIS2 in Germany: What Do Companies Need to Know in 2026?
The NIS2 Implementation Act has been in force since December 2025. Around 29,500 companies in Germany must now comply with registration, reporting, and risk management obligations. Duties, deadlines, fines, and implementation, the complete overview.
11 min readRead - 17 March 2026
NIS2 and ISMS: What Your Existing System Doesn't Cover
ISMS tools manage controls and audits, but they don't provide a NIS2 implementation path. Why ISMS vendors upsell consulting, where the guidance gap lies, and how KaitoSec closes it.
9 min readRead - 16 March 2026
NIS2 Fines: What Penalties Apply for Non-Compliance?
NIS2 violations can cost companies up to EUR 10 million or 2% of global annual turnover. Learn about fines for different violations, personal management liability, and what two practical scenarios reveal.
12 min readRead
Keep reading
Talk to us about your case.
Thirty minutes in which we show your questions on supervision, evidence and audits directly in KaitoSec.