ISMS (Information Security Management System)

A systematic framework for information security — ISO 27001 or BSI IT-Grundschutz

26 April 2026 · Category: NIS2 · Compliance-Kit

TL;DR

An information security management system (ISMS) is a systematic framework of policies, processes and measures for protecting information. The best-known standards: ISO/IEC 27001 (internationally certifiable) and BSI IT-Grundschutz (the German standard). A mandatory element of NIS2 compliance under § 30(2) no. 1 of the German BSI Act (BSIG).

What is an ISMS (Information Security Management System)?

Core ISMS components:

ISMS policy: top-level policy, approved by management
Risk analysis methodology (e.g. ISO 27005, BSI IT-Grundschutz)
Risk register with documented risks + treatment plan
Statement of Applicability (SoA): which ISO 27001 controls are applicable
Catalogue of measures: all technical + organisational measures
Effectiveness measurement: KPIs, audits, penetration tests
Continuous improvement (PDCA cycle)

Practical example

A typical ISO 27001 implementation for a 200-employee company:

Q1: ISMS policy + risk analysis methodology
Q2: Risk register + definition of measures
Q3: Implementation of the 93 ISO 27001 controls (where applicable)
Q4: Internal audit + external preparation
Following year: external audit + certification

Effort: 0.5-1 FTE for implementation + 0.3-0.5 FTE for ongoing operation.

ISMS obligation: legal position in Germany and Austria

NIS2 is an EU directive (Directive (EU) 2022/2555) and does not apply directly, but through the national implementing laws. The obligation to take risk management measures — with risk analysis and security concepts for the information systems as the core of an ISMS — is worded almost identically in Germany and Austria; the relevant provisions and the competent authority differ, however. 'BSI IT-Grundschutz' is a German standard; ISO/IEC 27001 is regarded as an internationally recognised reference standard in both jurisdictions.

Germany

§ 30(1) and (2) BSIG (BSI Act 2025) requires particularly important entities and important entities to take appropriate, proportionate and effective technical and organisational measures; the minimum catalogue comprises § 30(2) nos. 1 to 10. Risk analysis and security for the information systems (the ISMS core) is § 30(2) no. 1, supply chain security is § 30(2) no. 4. The reporting obligations (24 hours / 72 hours / 1 month) are governed by § 32 BSIG (joint reporting office of the BSI and the BBK), the obligations of the management by § 38 BSIG. Competent authority: Federal Office for Information Security (BSI).

Austria

§ 32(1) and (4) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (BGBl. I Nr. 94/2025) requires essential entities and important entities to take risk management measures based on an all-hazards approach; the minimum catalogue comprises § 32(4)(a) to (j) (risk analysis/ISMS core and supply chain security in § 32(4)). The reporting obligations (24 hours / 72 hours / 1 month) are governed by § 34(2) NISG 2026 (report to the competent CSIRT), the obligations of the management bodies by § 31(1) and (2) NISG 2026. Competent authority: Cybersecurity Authority (Cybersicherheitsbehörde, Austria).

Frequently asked questions

ISO 27001 or BSI IT-Grundschutz?

ISO 27001: internationally recognised, scalable for SMEs, expected by the market. BSI IT-Grundschutz: more detailed, KRITIS-compliant, less expensive without certification. A hybrid model is possible.

Is ISO 27001 enough for NIS2?

For the most part. ISO 27001 covers 70-80 % of the requirements of Section 30 BSIG. Gaps: the NIS2 reporting obligations 24/72/30 (§ 32), supply chain due diligence (§ 30(2) no. 4), the management obligations under § 38.

What does ISO 27001 certification cost?

Initial implementation: EUR 30,000-150,000 (SMEs). External audit: EUR 8,000-25,000 every 3 years. Ongoing maintenance: 0.3-0.5 FTE. The Compliance-Kit NIS2 Kit reduces implementation costs by 50-70 %.