Choosing ISMS software: the four ways to run ISO 27001
Anyone building or replacing an ISMS usually chooses between four ways: Excel and SharePoint built in-house, a point tool covering only ISO 27001, a large GRC suite, or a consulting retainer billed by the hour. Each carries in a specific situation, and each has a point where it breaks. This page compares the four honestly and lists the questions to settle before you decide.
The four ways, compared honestly
The same three questions for every option: What does it carry, where does it break, and what does switching cost once it does?
Excel and SharePoint built in-house
What it carries
For a first certification with a small scope, building it yourself is a legitimate start: full control, no licence cost, no rollout hurdle. Auditors accept clean spreadsheets.
Where it breaks
The cost arrives in operations. Version states, owners, follow-ups and the record of who decided what remain manual work forever. From the second site or legal entity onwards, maintenance turns into archaeology, and every surveillance audit brings similar preparation effort again.
Switching cost later
Instead of a data model there are documents. A later migration therefore resembles a rebuild, and history often only partly comes along.
Point tool covering only ISO 27001
What it carries
Guided structure, a pre-built catalogue, a fast start. If you want to run exactly one standard and nothing else, this is often the shortest path to the certificate.
Where it breaks
As obligations grow, the cut reaches its limits: BCM becomes a second tool, supplier risk a third, awareness a fourth, and sector catalogues wait for the vendor to add them. The data foundation splinters into islands kept in sync by hand.
Switching cost later
One export per island, mapping by hand. Feasible, but every island migrates separately.
Large GRC suite
What it carries
Suites are built for corporations with a dedicated GRC team and group-wide processes: deep workflows and role models for large organisations.
Where it breaks
Rollout and operations assume a dedicated specialist team, and the mid-market quickly pays for complexity it does not use. A known risk: after the rollout, the actual ISMS lives in Excel again because the suite is too heavy for daily work.
Switching cost later
High: suites are strategic commitments with a long horizon. Leaving one is a project of its own.
Consulting retainer by the hour
What it carries
Targeted expertise where it is missing: audit preparation, gap analysis, hard individual questions. Good advice accelerates any of the other options.
Where it breaks
As a permanent operating model, it remains open hours without a staffed function: advice arrives when a question comes up, but between two appointments nobody runs the ISMS. Evidence is produced in the project rather than in day-to-day operations, and the hourly budget is hard to plan ahead.
Switching cost later
Depends on where the results live. If documents and decisions sit in your organisation, any other way can build on them.
Where Cybervize sits in this comparison
Two ways: without a CISO of your own, the vCISO mandate staffs the function from €3,600/month and delivers the evidence, with the platform included. With your own CISO, you license OdySecure. Either way the modules run on one data foundation and are built for ongoing operations, not a one-off audit.
ISMS, BCM, assessment, TPRM and awareness share one data foundation: from assessment gaps you create measures with one click, BIA data validates continuity plans, training rates become audit evidence.
50 frameworks kept as a catalogue, from ISO 27001 and BSI Grundschutz++ to sector rules. New catalogues arrive via OSCAL import or are created directly in the platform, without waiting for a vendor.
Operated in Germany. The AI layer runs sovereign on self-operated models, with your own keys, or managed: three operating modes, configurable per tenant.
Multiple sites and legal entities on one data foundation, with site comparison and consolidated evidence. Self-assessments relieve plants during audits, including IEC 62443.
Licensed per module at a fixed annual price. The metric is digitally connected people, with no named-user limit. Entry prices per tier are published on the pricing page.
Without a CISO of your own, we staff the function in a vCISO mandate: a senior CISO runs the ISMS and the evidence and works with OdySecure to do so. The platform is included in the mandate, priced as a fixed monthly fee rather than open hours.
These questions separate the options faster than any feature list. Ask every vendor, including us.
1.Where does the control catalogue come from, and how do new standards get in?
Purchased catalogues age with the vendor's release cycle. What matters is whether you can load new or custom catalogues yourself, for instance via OSCAL, the official NIST format.
2.Does the tool carry multiple sites and legal entities on one data foundation?
Retrofitting tenants, plants and subsidiaries is among the most expensive rebuilds. If you have one site today and two tomorrow, ask the question today.
3.Is evidence produced in daily operations, or collected for the audit?
That is the difference between an ISMS and a folder. When measures, risks and training continuously produce audit evidence, preparation before every audit shrinks substantially.
4.Where do data and AI run, and under whose control?
Some tools route compliance data through model providers outside Europe. Clarify data residency, the operating model, and whether the AI data flow can be controlled per tenant.
5.How is the price built: a licence with a clear metric, or open hours?
Comparison starts with the metric. Ask what is counted, what happens as you grow, and whether production workers without a digital identity drive the price.
6.What does the way in cost, and what does the way out cost?
Rollout and migration from your current state are plannable projects. The export at the end is the most honest vendor question: whoever only lets data in has a reason.
What the platform is built for, and what it is not
Built for this
Mid-market and corporate organisations with several obligations at once: ISO 27001 in operation, plus BCM, supplier risk or sector rules such as NIS-2 and DORA.
Organisations with multiple sites or legal entities that need consolidated evidence instead of four island tools.
Manufacturers that want to include plants and OT environments, with self-assessments instead of an audit caravan.
Organisations with their own CISO that want to run the ISMS themselves: via the licence, with an implementation project if you wish.
Other ways are better for this
You need exactly one certificate for a small scope and as little operation as possible afterwards: a point tool or a clean in-house build is often the leaner way.
Your group has set a GRC suite strategically and group-wide: replacing it is rarely the right project. Worth examining is the assessment module as a complement for plant self-assessments.
You are looking for security leadership rather than a tool: then the vCISO mandate is the right way. We staff the CISO function, with the platform included. For crises and vacancies there is our Interim CISO.
Test both ways against your case
If you have your own team, the demo shows OdySecure with your standards and sites. Without a CISO of your own, an intro call clarifies how the vCISO mandate covers your requirements.
A serious answer starts with the model, not a number: point tools are licensed per user or package, GRC suites come with their own rollout project, and hourly retainers have no natural end. What matters is the pricing metric: OdySecure is licensed per module at a fixed annual price, counting digitally connected people with no named-user limit. Entry prices per tier are published on the pricing page. Without a CISO of your own, the vCISO mandate starts at €3,600/month, platform included.
Is Excel enough for ISO 27001?
For a first certification with a small scope: yes. Auditors accept clean spreadsheets, and for a small organisation with one site the in-house build is a legitimate start. The bill arrives in operations: version states, follow-ups, ownership and years of evidence are manual work, and from the second site or the second obligation next to ISO 27001, the effort grows faster than the team.
What separates ISMS software from a GRC suite?
The cut. ISMS software runs a management system based on ISO 27001; a GRC suite aims to model a corporation's governance, risk and compliance, with the rollout time, role complexity and operating team that entails. Between the two sits the platform approach: several modules on one data foundation, carrying obligations such as ISO 27001, BCM and supplier risk together, without the rollout and operating weight of a suite.
How do new standards and catalogues get into the platform?
Three ways: 50 frameworks are kept as a catalogue, from ISO 27001 and BSI Grundschutz++ to IEC 62443 and sector rules. New catalogues can be loaded via OSCAL import, the official NIST format for security catalogues. And custom catalogues, such as group requirements, are created directly in the platform and connected to ISO 27001 via crosswalk.
Does ISMS software also cover NIS-2, DORA and BCM?
A point tool for ISO 27001 usually does not, and that is exactly where many multi-tool setups break. In OdySecure, ISO 27001, NIS-2, DORA, BCM and supplier risk run on one data foundation: one measure satisfies several obligations, and evidence is derived per framework instead of being maintained per tool.
What determines rollout time?
Less than the brochures suggest on the tool side, and more on scope: number of sites, maturity of what exists, and how much has to be migrated. With OdySecure, the rollout is scoped per expansion stage. With your own team you take over operations, with an implementation project if you wish; in a vCISO mandate your vCISO leads the rollout. We scope the specifics for your organisation in the first conversation.
