Energy supply
Consolidating security scan data in Jira
Results from several vulnerability scanners, including Tenable and Rapid7, are consolidated with Frends and stored in Jira.
Consulting
ISO 27001 & ISMS
Consulting, implementation and management of your information security management system based on ISO/IEC 27001:2022, a solid foundation for NIS2 compliance.
Consulting
We assess the current state of your information security and show which measures are relevant for you.
Implementation
We build your ISMS step by step, with risk assessment, policies and the right controls from the standard.
Management
We support ongoing operations, internal audits and continuous improvement.
What is ISO 27001?
ISO/IEC 27001:2022 is the internationally recognised standard for information security management systems (ISMS). It helps organisations protect information systematically, whether it exists in digital or analogue form or as knowledge.
In an increasingly connected world, information security is a key success factor. The standard provides a clear framework for ensuring the confidentiality, integrity and availability of information in the long term.
Why get certified?
The controls of the standard help to mitigate risks in a targeted way, for example:
- Threats from cyber attacks
- Data theft by third parties
- Vulnerabilities caused by outdated systems
- Lack of awareness among employees
To this end, the standard specifies organisational, technical, physical and people-related measures. Together with you, we record and assess the IT risks and define measures before anything happens, so that critical systems and data are protected and operations continue.
What an ISMS includes
- Scope and context: which sites, processes and systems the ISMS covers.
- Risk management: systematically identifying, assessing and treating risks to your information.
- Statement of applicability: which of the 93 controls in Annex A apply to you and how they are implemented.
- Policies and responsibilities: clear rules and roles, backed by top management.
- Measure and improve: internal audits, management review and continual improvement.
Useful tools for this are an automatically maintained CMDB as your asset inventory and XISUITE, where you map the clauses of the standard as processes and build your certification step by step.
The road to certification
We support you from the first assessment of where you stand to the certification audit and beyond:
Assess where you stand
A gap analysis shows where your organisation stands against the requirements of the standard.
Assess the risks
We identify and assess the risks to your information and systems.
Build the ISMS
Policies, processes and measures: organisational, people-related, physical and technical.
Involve your people
Training and awareness, so that information security becomes part of everyday work.
Internal audit
We check the effectiveness of the ISMS and close any remaining gaps.
Certification
The certification audit is carried out by an accredited certification body, and we support you throughout.
Once in operation, we look after your ISMS and keep improving it.
ISO 27001 and NIS2
Among other things, the NIS2 Directive requires the organisations it covers to take cybersecurity risk-management measures and to report significant incidents, and it holds top management accountable. An ISMS based on ISO 27001 covers a large part of these measures; we add reporting channels and the involvement of management where needed.
In practice
Frequently asked questions
Can’t find your question? Ask us directly: Contact
How does ISO 27001 relate to NIS2?
ISO 27001 describes a modern information security management system and is therefore a good foundation for meeting the requirements of the NIS2 Directive.
Is the standard only meant for large companies?
No. The standard provides recognised guidelines and measures, regardless of the size and industry of the company.
How long does the road to certification take?
That depends on your starting point, the scope and the resources available. After the gap analysis you know which steps are needed and get a realistic timeline.
Who issues the certificate?
An accredited certification body. The certificate is valid for three years, with annual surveillance audits in between. We prepare you for the audits and support you throughout.
What is the statement of applicability?
A central document of the ISMS. It records which controls from Annex A of the standard apply to your organisation, why, and how far they have been implemented.
What changed with the 2022 version?
Annex A was restructured: 93 controls in four themes instead of 114 in 14 clauses, including new ones such as threat intelligence and information security for the use of cloud services. Certificates to the old 2013 version ceased to be valid on 31 October 2025.
Related services
Let’s talk about your plans.
Whether it’s a first idea, a project already under way or an existing IT landscape: we listen, put things into context and show you concrete next steps.
Your contacts: Christian, Tobias and Michael, the founders of AmberTech Solutions.