47 Excel files and a login

“Show me your ISMS tool.” We hear this request regularly in conversations with clients. The answer is often a SharePoint folder with 47 Excel files, and there is a login too. The folder shows two gaps at once: nobody is running it, and nothing holds it together.

What sets an ISMS tool apart from well-organised file storage is the subject of our practice test from March.

Anyone who has to implement NIS-2 makes two decisions that belong together. The first is: who leads the implementation in day-to-day business, and who provides the evidence? The second concerns the tool that person works with. The first determines which tool fits. The tool determines whether that person steers or collects evidence by hand.

The law has assigned the accountability: it lies with management. Management needs someone to run the work. That can be a person in-house, a consultant billed by the hour or a staffed function.

What the law requires, and what it does not

Section 38(1) BSIG obliges the management of essential and important entities as follows: “to implement the risk management measures to be taken by these entities under § 30 and to supervise their implementation” (our translation). If they breach this duty, paragraph 2 makes them liable to their entity for culpably caused damage under the rules of company law. Where company law contains no such rule, they are liable under the BSIG itself. Paragraph 3 also requires management to attend training regularly.

What has to be implemented is set out in § 30 BSIG: “appropriate, proportionate and effective technical and organisational measures” (our translation), specified in ten areas. They range from risk analysis, incident handling and supply chain security to multi-factor authentication. The entity has to document its compliance.

For significant security incidents, § 32 BSIG prescribes staged reporting. It starts with an early initial report, due without undue delay and no later than 24 hours after becoming aware of the incident. Who triggers it in an emergency has to be settled in advance.

NIS-2 does not require a CISO position. Neither § 30 nor § 38 BSIG prescribes a particular role. What is required are measures and their documentation by the entity. Management has to implement the measures and supervise their implementation. Our conclusion: the work can be delegated, management's duties cannot. Who takes on the work is an organisational question. The answer determines which software fits.

Six ways to implement

The vendors named are examples, based on their own descriptions as of 14 October 2026. In our view, no single way is best for every organisation; what matters is the starting point. The ways can overlap. The vendor examples refer to the features described; additional services and the actual division of tasks need to be checked in each offer.

The six ways at a glance, each with the starting point in which, in our view, that way fits:

• Do it yourself with Excel and SharePoint: a small scope, and one person in-house knows the subject and is given time for it.
• Expert tool with your own team: an experienced information security officer is in-house and wants a tool that follows their method.
• Governance platform: a group has its own GRC team, and the platform is established.
• Platform with assistants or templates: someone in-house takes on the implementation as their task and is given the time for it.
• Platform with expert help or a consulting project: you want to combine software with external specialist support.
• A staffed function with a tool: no CISO of your own is appointed or planned.

Every way leaves the same question to settle: who runs the work, and who takes over when that person changes?

1. Do it yourself with Excel and SharePoint

Fits when the scope is small and one person in-house knows the subject and is given time for it. For a first ISO 27001 certification with a small scope, a cleanly run in-house setup is a legitimate start.

Limit: for an in-house setup, we would check in particular how versions, follow-ups and decisions remain traceable when responsibilities change. And how a report under § 32 can be made on time out of the documents.

2. Expert tool with your own team

This covers, for example, verinice, in the vendor's words “Das souveräne OpenSource-Tool für GRC, ISMS, DSMS und BCM” (the sovereign open source tool for GRC, ISMS, DSMS and BCM). verinice names BSI IT-Grundschutz and ISO 27001, among others. It also covers the HiScout GRC software, which according to the vendor is used in numerous federal and state authorities and in the private sector. HiScout names IT-Grundschutz, BSI guidelines and ISO standards.

Fits, in our view, when an experienced information security officer is in-house and wants a tool that follows their method.

Limit: before choosing the tool, we would clarify who will maintain it and take over when personnel change.

3. Governance platform

One example is OneTrust. OneTrust calls its offering the “AI-Ready Governance Platform” and lists Tech Risk & Compliance as one of its areas.

Fits, in our view, when a group has its own GRC team and the platform is established. We would then first check how NIS-2 can be mapped there.

Limit: if a platform is to be introduced for NIS-2 alone, we would first clarify who will handle implementation and ongoing administration.

4. Platform with assistants or templates to support the work

ISMS.online lists “Vorgefertigte Richtlinien- und Kontrollvorlagen” (ready-made policy and control templates) as a feature. According to the vendor, SECJUR offers intuitive assistants that let you navigate the compliance process yourself with ease, and a certified expert on request.

Fits, in our view, when someone in-house takes on the implementation as their task and is given the time for it.

Limit: before choosing a platform, we would clarify who will carry out the implementation and who will inform management about deviations.

5. Platform with expert help or a consulting project

This model combines software with consulting. DataGuard describes its own model like this: “Automatisiert, wenn Sie es wollen, und Expertenhilfe, wenn Sie sie brauchen” (automated when you want it, expert help when you need it).

Fits, in our view, when you want to combine software with external specialist support. Clarify for each offer which tasks the experts take on, whether the support is project-based or ongoing, and who carries on after it ends.

6. A staffed function with a tool

An external CISO fills the function permanently as a mandate and works on a platform on which the evidence is produced. That is how we offer it.

Fits when no CISO of your own is appointed or planned. Management then needs someone who implements the measures for the agreed term of the mandate, keeps management informed and prepares upcoming audits.

Limit: if a capable CISO of your own is in place, a mandate would duplicate the role. For that case there is OdySecure as a licence on its own.

Questions from the buyer's side

1. Who runs the implementation, and who keeps management informed? If the answer is “you do”, the working time belongs in the calculation.

2. Is evidence produced continuously, or gathered before the audit? We read the documentation duty in § 30 as an ongoing task.

3. Are all ten areas of § 30(2) covered? Ask specifically about the supply chain, business continuity and assessing whether the measures work.

4. How does a report under § 32 work? Who decides on a Friday evening whether an incident has to be reported, and who arranges the initial report without undue delay, no later than 24 hours after becoming aware?

5. Do several standards share one data basis? One measure should be able to serve ISO 27001 and NIS-2 at once without being maintained twice.

6. Where is the data, and who operates the platform? Ask about the data centre, the operator and the path your data takes to AI models.

7. Is the price public, and what does it include? An offer only becomes comparable once it is clear whether support is in the price or added by the hour.

8. What happens after the audit? The obligations under § 30 apply on an ongoing basis. Who carries risks, measures and training forward in the second year?

Want to work through the eight questions for your organisation? In a 45-minute consultation, we go through them with you, applied to your situation.

What remains when external support ends?

With external support, the question is what remains when it ends. For a handover, we would check which decisions are documented and who will continue the work.

In a vCISO mandate the function stays staffed for as long as the mandate runs. A senior CISO runs the ISMS and the evidence, using OdySecure. After the mandate ends, you can continue to use OdySecure with an internal CISO on the basis of a separate platform licence. For leaving, there is a JSON export that marks its own limits. We explain before the contract is signed which data is exported and which restrictions apply.

Documented records make a handover easier; they do not replace personal experience. A handover should therefore also establish what knowledge the incoming team needs.

How we do it: two ways

Without a CISO of your own, we staff the function in the vCISO mandate from €3,600 net per month, in the entry tier with around two days a month. The work runs on OdySecure, the security platform by Cybervize, which is included in the mandate. The vCISO leads the implementation of the information security measures, runs the ISMS and the evidence and keeps management informed. The obligations remain with the entity and its management. The minimum term is six months, after which the mandate can be cancelled monthly.

With a CISO of your own, you license OdySecure alone, from €12,900 net per year with annual billing in the Core tier. Senior CISO support is not included and can be booked separately. For a vacancy or an audit under time pressure there is the Interim CISO, project-based at typically €8,000 to €15,000 per month and without a platform commitment. All prices are net, plus VAT.

OdySecure runs five modules on one data basis: ISMS, BCM, Assessment, TPRM and Awareness.

50 frameworks are held in the catalogue. The list with the catalogue depth of each entry is on our page Standards and regulation. The platform runs in data centres in Germany operated by OVHcloud. It steers the work and provides the evidence. It does not detect attacks or defend individual systems; that still takes technology and operations in-house or at a service provider.

Reference: support with the introduction of NIS-2 in the energy sector.

When we are not the right way

Where a capable CISO of your own is in place, we consider a mandate unnecessary. If a group has set a GRC suite across the organisation, we would first check how it can be used for NIS-2. For a first ISO 27001 certification with a small scope, a cleanly run in-house setup is, in our assessment, also a possible start.

Frequently asked questions

Does NIS-2 require a CISO?

No. § 30 BSIG requires risk management measures and their documentation, and § 38 BSIG obliges management to implement them and supervise their implementation. The law does not prescribe a particular position. A vCISO is one way to implement the measures, not a legal requirement.

Can management hand its duties over to a vCISO?

No. A vCISO can take on the operational execution, that is, implementing the information security measures. Management's statutory duties under § 38 BSIG to implement, supervise and attend training remain in place, as do the entity's obligations. That is our professional assessment; the legal assessment of an individual case belongs with a law firm.

Is OdySecure included in the vCISO mandate?

Yes, OdySecure is included in the Cybervize vCISO mandate. The reverse does not apply: the licence alone includes no senior CISO support.

What does each way cost?

Our prices are public on the pricing page. The vCISO mandate starts at €3,600 per month and OdySecure alone at €12,900 net per year with annual billing in the Core tier. Interim CISO is typically €8,000 to €15,000 per month. For other vendors, their own pricing applies. Compare what each includes, and count your own working time.

What happens to our data when the mandate ends?

After the mandate ends, you can continue to use OdySecure with an internal CISO on the basis of a separate platform licence. If you stop using it, you receive a JSON export that marks its own limits; after the contract ends, scheduled deletion follows. We explain before the contract is signed which data is exported and which restrictions apply.

The next step

Which leaves the SharePoint folder from the beginning. The 47 Excel files show that someone has made a start. What they lack is someone who runs them and a tool that holds them together. Which of the six ways provides that for your organisation depends on who carries the work today and who should carry it tomorrow. We are happy to discuss it for your case in a no-obligation 45-minute consultation. If you want to compare the tools first, you will find the options on our page Choosing ISMS software.