Guides
How to set up ISO 27001, NIS2 and BSI IT-Grundschutz for the first time.
Each guide runs from the first classification through to the evidence, and names the provisions you will have to cite along the way.
The four guides
ISO 27001 checklist for small and medium businesses
Eight steps from the scope to the certification audit, written for teams without a compliance department of their own.
- Understand the structure of ISO 27001 and Annex A controls
- Perform a gap analysis to identify your starting point
- Build a realistic certification timeline for your organisation
5 min readRead the guideNIS2 from the scope check to the reporting chain
In Germany, the federal government estimates that some 29,000 to 30,000 entities fall under the NIS2 implementation act. This guide settles whether yours is one of them and what follows if it is.
- Determine whether your organisation falls under NIS2
- Map the ten minimum measures of Section 30 BSIG onto your own controls
- Align your implementation plan with the duties already in force
6 min readRead the guideGetting Started with BSI IT-Grundschutz
From the information domain through the protection needs assessment to the Grundschutz check, explained for a first ISMS project.
- Tell the three qualification levels of the IT-Grundschutz methodology apart
- Navigate the IT-Grundschutz-Kompendium and its Bausteine (modules)
- Choose the right approach for your organisation's size and risk profile
5 min readRead the guideIT-Grundschutz tools compared
From the end of GSTOOL to tool selection: open source or commercial, self-operated or managed, Grundschutz alone or one data model for four management systems.
- Read the tool landscape after the end of GSTOOL
- Separate open-source tools from commercial ones by operating effort
- Apply five selection criteria for agencies, KRITIS and the Mittelstand
4 min readRead the guide
How the guides are built
Every step with the provision you will cite.
The guides start with the question of whether and how far you are in scope and end with the evidence an auditor or an authority wants to see. Wherever a duty is named, the article or requirement behind it is named too.
Which step is next for you?
In a demo we walk through it with your case, directly in KaitoSec instead of a spreadsheet.