01
The team works around the system
When risks, controls and evidence live outside the tool, there is no reliable shared state.
Migration
Preserve the estate. Improve the operating model.
Bring assets, risks, controls and documents from your current system into a connected workspace: with reviewed mapping, source references and sign-off before cutover.
Why migrate
When a move pays off
Migration is not a goal in itself. It pays off when the legacy tool creates more friction than value.
02
Routine consumes professional time
KaitoSec prepares mappings and drafts from the migrated context. Accountable people review and approve.
03
Decisions lose their context
Guidance, rationale and approval are documented on the work item so knowledge remains with your organisation after the project.
Four phases
The migration plan
Four controlled stages from estate review to sign-off. Duration and cutover depend on data volume, export quality, integrations and the desired parallel run.
01Stage 1
Inventory
We assess your legacy tool, its data model and the export options. Scope, goal and interfaces are set.
- Inventory of all legacy objects
- Export feasibility test (CSV, XML, API)
- Migration scope and cutover date agreed
- Risks and edge cases documented
02Stage 2
Mapping and dry run
We map your data model onto KaitoSec structures and run a dry import into a sandbox. Rehearsal before the real cutover.
- Source-to-target mapping signed off
- Sandbox workspace populated
- Spot checks by your team
- Gaps and adjustments logged
03Stage 3
Migration
Structured import into the production workspace. Every object carries its source reference for the audit trail.
- Assets, risks, controls, policies imported
- Frameworks activated and mapped
- Audit trail with source IDs
- Reporting prepared for the stage 1 audit
04Stage 4
Cutover and shutdown
Your team signs off the new state, admins are trained and the transition is controlled. The legacy tool is decommissioned only after your approval.
- Sign-off protocol signed
- Admin training delivered
- Legacy tool read-only or archived
- Handover to customer success
What we migrate
Object types in scope
What the legacy tool keeps structured, we move structured. What sits as PDFs on SharePoint lands as linked documents in the workspace.
Asset register
IT systems, applications, sites, owners, classification.
Risks
Risk assessments with likelihood, impact and control mapping.
Controls
Control catalogue with owners, status and due dates.
Policies
Existing policies. Optional mapping to templates from the Open Compliance Registry.
Evidence
Audit evidence, training records, minutes. Linked back to the source or attached.
Mappings
Existing framework mappings (ISO 27001, BSI IT-Grundschutz, NIS2, DORA) ported or recreated.
Source systems
Migration from these tools
We have migration paths documented for the common DACH ISMS tools. Other sources we vet in the discovery call.
MIG-01
verinice
Review tree structures, Grundschutz profiles, custom fields and document links before defining the target model.
We import
Asset trees, BSI Grundschutz modules, risks, ISO 27001 controls, documents. Export via verinice XML or CSV.
MIG-02
HiScout
Clear separation of ISMS, BCMS and DSMS objects prevents customer-specific structures from being lost during import.
We import
ISMS, BCMS and DSMS data, mappings, risks, controls. Export via HiScout interface or structured reports.
MIG-03
eramba
A move from self-hosting must cover documents, history and operating ownership as well as GRC records.
We import
Controls, risk register, policy library, audit plans, incidents. Export via eramba API or CSV.
MIG-04
SAVe / QSEC
Database or report exports need an early sample so controls, assets and audit history can be mapped correctly.
We import
Control catalogues, asset lists, audit reports. Export via CSV or database dump after review.
MIG-05
Secfix
Automated evidence and integration states need to be translated from source logic into accountable KaitoSec work items.
We import
Controls, evidence, risk register, policies, integration state. Export via Secfix API or CSV.
MIG-06
Vanta
Controls, evidence and integration signals need review against the required DACH and Grundschutz scope.
We import
Controls, evidence, policies, risks and integration status. Export through the Vanta API or structured reports.
MIG-07
Kertos
Data protection records are connected to the relevant assets, vendors, risks and owners in the target model.
We import
Processing activities, vendors, controls, evidence and privacy records. Export through available interfaces or structured files.
MIG-08
ISMS.online
Templates, tasks and evidence are reviewed to decide which content belongs in the shared management model as accountable records.
We import
Controls, risks, policies, evidence, audits and task records. Export through reports and structured data extracts.
Controls during cutover
Migration with reviewable checkpoints
Every migration carries risk. That is why we use a dry run, spot checks, source references and documented sign-off.
01
Sandbox before cutover
Sandbox first, production workspace second. You see the result before the legacy tool gets switched off.
02
Source reference per object
Every imported object carries the source ID. End-to-end audit trail from old system to new.
03
Agreed fallback path
Parallel run, read-only period and follow-up imports are defined for your source system in the migration plan.
04
Transparent migration scope
Objects, interfaces, edge cases, acceptance criteria and pricing model are agreed in writing before cutover.
05
Customer success handover
After migration, customer success takes over. Onboarding weeks plug in directly.
Migrate with structure.
Bring the source system, export options and next audit date. We define scope, risks and a realistic cutover path.