# Information Security Management / ISMS-Software

> Swiss GRC bietet mit der SwissGRC® Platform eine ISMS-Software, die Assets, Kontrollen, Risiken und Nachweise verknüpft. Sie unterstützt Organisationen bei ISO 27001, NIS2 und DORA und hält den ISMS-Betrieb laufend prüfbereit.

- URL: https://swissgrc.com/en/information-security-management-isms-software/
- Publisher: SwissGRC®
- Published: 2023-02-23
- Last updated: 2026-10-07

## Key facts

- Die SwissGRC® Platform verknüpft Schutzbedarf, Kontrollen, Risiken, Vorfälle und Massnahmen mit dem jeweiligen Asset.
- Der Schutzbedarf eines Assets ergibt sich aus der Bewertung von Vertraulichkeit, Integrität und Verfügbarkeit.
- Ein einziges Kontrollset deckt ISO 27001, NIS2, DORA, NIST CSF, IT-Grundschutz und CIS ab.
- Das Risikomanagement folgt ISO 27005 und arbeitet mit Risikomatrix, Dashboards je Organisationseinheit sowie Massnahmen mit Verantwortlichen, Fälligkeit und Fortschritt.
- Zur Audit-Unterstützung gehören Zertifizierungsunterstützung mit Statement of Applicability, interne Audits, Richtlinienmanagement und Ausnahmemanagement.
- Die Plattform bietet eine Integration mit SNOW, LeanIX und weiteren Quellen für das Asset-Inventar.

Information Security (ISMS)

# Secure on paper. And when it counts?

Raise your security level, strengthen cyber resilience.
**Assets, controls, risks and evidence connected**, for ISO 27001, NIS2 and DORA.

[Request Demo](https://swissgrc.com/en/information-security-management-isms-software/#contact) [Explore features](https://swissgrc.com/en/information-security-management-isms-software/#features)

Trusted by leading organizations

What makes the difference

## From a documented ISMS to an effective ISMS

Policies, asset lists and control catalogues exist in most organizations. What sets them apart is whether they are connected.

The common starting point

### An ISMS that lives for the auditor

Assets in Excel, controls in a Word catalogue, risks on a separate list. The connection is only made during the audit, by hand.

- Assets, controls and risks on separate lists
- Evidence is collected shortly before the audit
- Every standard is mapped and maintained on its own
- Exceptions expire without anyone noticing

With the SwissGRC® Platform

### An ISMS that works day to day

Protection requirements, controls, risks, incidents and actions stay linked to the asset. Evidence builds up continuously in the process, not in a final sprint.

- Protection requirements and controls linked to the asset
- Evidence builds up continuously, the ISMS stays audit ready
- One control set for ISO 27001, NIS2, DORA and more
- Exceptions, deadlines and actions monitored automatically

The SwissGRC® Platform at a glance

## Your entire ISMS, in one place

Capture, assess, treat, monitor and report. Click through the six views.

Protection requirements analysis

### Every asset with its protection requirement

Processes, information, systems and applications in one inventory. Confidentiality, integrity and availability are rated, **and the protection requirement follows from them**.

- Complete asset inventory with clear ownership
- Protection requirement derived from confidentiality, integrity and availability
- Integration with SNOW, LeanIX and other sources

![Asset inventory with protection requirements and CIA rating in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ISMS_CIA-1024x689.png)

Dependencies

### See what depends on which asset

Trace the connections between processes, information, systems and applications and recognize **how a single change ripples through**.

- Dependencies as a graph instead of a table
- Protection requirements traceable along the chain
- Single points of failure and bottlenecks spotted early

![Asset hierarchy with dependencies between assets in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/07/Asset-Hierarchie-Screenshot-1024x611.png)

Control assessment

### Implementation status per control, evidenced

Questionnaires and workflows determine the implementation status of every control, with evidence file, owner and due date. **Coverage becomes visible**.

- Assessments for ISO 27001, IT-Grundschutz and more
- Evidence attached directly to the control
- Gaps lead to actions or documented exceptions

![Control assessment with questionnaire and progress in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ISMS_Assessment-1024x603.png)

Risk management to ISO 27005

### Risks assessed, actions tracked

Capture, analyse, assess and prioritize information security risks. Treatment runs **through workflows with clear ownership and deadlines**.

- Risk matrix and dashboards per organizational unit
- Actions with owner, due date and progress
- Linked to assets, controls and incidents

![Information security risk management in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ISMS_Risk-Management-1024x603.png)

Incident and vulnerability management

### From the event to the cause and back

Security events, incidents and vulnerabilities captured and assessed centrally, with the **full cause and effect chain** down to the affected asset.

- Incident dashboard by severity and over time
- Vulnerabilities linked to source, asset and risk
- Treatment tracked through workflows

![Dashboard for security incidents and events in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ISMS_Incidents-1024x603.png)

Reporting

### Security posture reported to the right audience

Assets, control status, audit results and risks in one dashboard. **One picture that both management and the auditor can rely on**.

- Control status and coverage per standard
- Risks, incidents and findings side by side
- Custom reports for every committee

![ISMS dashboard with risks, incidents and findings in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ISMS_Dashboard-1024x693.png)

Built on **recognized standards and frameworks**, one control set for every evidence obligation.

ISO/IEC 27001:2022 ISO/IEC 27005 [NIS2](https://swissgrc.com/en/nis2/) [DORA](https://swissgrc.com/en/dora/) NIST CSF BSI IT-Grundschutz CIS Controls PCI-DSS

Audit and evidence

## From the Statement of Applicability to defensible evidence

Certification is not a project, it is a cycle. The platform carries it, from the policy through to the management review.

Certification support

Normative requirements and the Annex A controls covered. The Statement of Applicability is produced with justification and a reference to the governing policy.

Internal audit

Plan audits, run them through assessments, document findings and improvement actions and track them through to closure.

Policy management

Integrated document management with versioning, review and approval workflow plus scheduled recall to verify that policies remain current and appropriate.

Exception management

Assess, approve and time limit exceptions to security requirements. The platform monitors the deadlines and flags expiry before it turns into a risk.

New evidence obligations

NIS2 and DORA demand evidence that goes beyond certification. Both draw on the same control base.

[NIS2](https://swissgrc.com/en/nis2/) [DORA](https://swissgrc.com/en/dora/) [Standards and frameworks](https://swissgrc.com/en/standards-frameworks)

Advantages and added value

## Greater effectiveness, less effort

Comprehensive and simple at the same time. That is what drives adoption and lifts maturity.

#### Everything connected to the asset

Protection requirements, controls, risks, incidents and actions all hang on the asset. The connection can be queried, not reconstructed.

#### One control set, many standards

Assess once, evidence many times: ISO 27001, NIS2, DORA, NIST CSF, IT-Grundschutz and CIS on the same foundation.

#### Audit ready at any time

Evidence builds up continuously in the process. Internal and external audits stop being exceptional events.

#### Part of a connected GRC system

Information security shares one foundation with ICS, risk management, BCM, data protection and TPRM.

#### Stronger security culture

Workflows involve asset and process owners in their day to day work, not just once a year.

#### Higher maturity through standards

Standardized along ISO/IEC 27001 and 27005: one consistent, automated approach across the entire organization.

Contact and demo

## See our ISMS solution in action

In a personal demo we walk you through the SwissGRC® Platform and show how assets, controls, risks and evidence work together.

[Request Demo](https://swissgrc.com/en/demo) [Contact Sales](https://swissgrc.com/en/sales)

## Frequently asked questions

### Was leistet die ISMS-Software von Swiss GRC?

Die SwissGRC® Platform bildet das gesamte ISMS an einem Ort ab: Schutzbedarfsanalyse, Abhängigkeiten, Kontrollbewertung, Risikomanagement, Vorfall- und Schwachstellenmanagement sowie Reporting. Alle Elemente bleiben mit dem Asset verknüpft.

### Welche Standards und Regulierungen unterstützt die ISMS-Software?

Genannt werden ISO/IEC 27001:2022, ISO/IEC 27005, NIS2, DORA, NIST CSF, BSI IT-Grundschutz, CIS Controls und PCI-DSS. Für ISO 27001, NIS2, DORA und weitere gilt ein gemeinsames Kontrollset.

### Wie unterstützt die Software die ISO-27001-Zertifizierung?

Sie deckt die normativen Anforderungen und die Annex-A-Kontrollen ab. Das Statement of Applicability entsteht mit Begründung und Verweis auf die massgebende Richtlinie.

### Wie bleibt ein ISMS jederzeit auditbereit?

Nachweise entstehen laufend im Prozess statt kurz vor dem Audit. Fristen und Ausnahmen werden automatisch überwacht, und Abläufe werden vor dem Verfall gemeldet.

### Wie kann man die ISMS-Lösung von Swiss GRC kennenlernen?

Auf der Seite kann eine persönliche Demo angefragt werden. Darin zeigt Swiss GRC, wie Assets, Kontrollen, Risiken und Nachweise in der SwissGRC® Platform zusammenspielen.