With Ariadne ISMS, you manage information security where your organization already works: in its business processes. You assess once which information and processes are critical, and the system derives how well your IT systems, providers and locations need to be protected. This lets you prioritize risks and measures transparently and justify the required protection of every system in an audit.
What the ISMS module helps you achieve
The ISMS module is a web-based platform for operational information security management. You use it to maintain information, business processes, assets, risks and measures. It builds on Ariadne: your business processes can reference pages from your management system directly.
- One login for both products: You open the ISMS module from Ariadne via the left sidebar and sign in with single sign-on (SSO).
- ISO 27001 methodology: You start with business processes and information, not with individual IT systems.
- English interface: The controls are in English. Scales, BIA scenarios and categories may be in another language because they are configured for your organization.
Why you start with business processes
Many ISMS projects start in IT: every asset is checked individually against a threat catalog. This produces huge matrices without real prioritization. Ariadne ISMS reverses the perspective.
| Bottom-up (classic IT security) | Top-down (Ariadne ISMS) |
|---|---|
| “What do we secure?” | “What must we not lose?” |
| Every asset individually against a catalog | Assess information and processes once |
| Protection goals on every asset | Required protection is derived to assets automatically |
| Criticality based on gut feeling | Criticality follows from the business |
Prioritization instead of a scattergun approach
Effort where it matters
You spend time on the systems that carry truly critical information and processes. Systems with low required protection are recognizable at once, so you can handle them leanly.
Critical infrastructure becomes visible
Dependencies instead of isolated views
Dependencies show you which system carries many processes and information items at once, for example a central file server. Such hubs are easy to miss in a plain asset list.
A shared basis with quality management
Same processes, two perspectives
Quality management talks about processes, information security about assets and protection goals. Because the ISMS module builds on your Ariadne processes, both sides work with the same process landscape. You also involve the business units instead of delegating the ISMS entirely to IT, as ISO 27001 requires.
Five stations to a managed risk
Working in the ISMS module follows five stations. Each one builds on the previous one, and you can go back and add details at any time.
| # | Station | What you do in the product | Typically involved |
|---|---|---|---|
| 1 | Capture primary assets | Create a business process or take it over from Ariadne, link information | Process owner |
| 2 | Derive protection goals | Classify information (confidentiality, integrity, data protection), perform a business impact analysis (BIA) on the process | Information security officer (ISO), process owner |
| 3 | Assign secondary assets | Create assets, maintain dependencies from process to asset with mode and information | IT |
| 4 | Manage risks | Capture a risk on an asset, start managing it, assess it | ISO and IT |
| 5 | Implement measures | Define the treatment, create and complete measures, reassess the risk | Measure owners |
An example from start to finish
Here is the path using the process “Create quotation” as an example:
| Level | Content |
|---|---|
| Process | “Create quotation”, owner: head of sales |
| BIA | An outage longer than 24 hours is no longer tolerable, which results in a maximum tolerable period of disruption (MTPD) of 24 hours |
| Information | Costing and pricing data: confidentiality and integrity severe |
| Information | Customer contact data: confidentiality medium, integrity low, personal data |
| Process (derived) | Confidentiality and integrity severe, personal data |
| Asset | CRM with dependency “Required”: inherits confidentiality and integrity severe, the personal data flag and the availability requirement of the process |
| Risk | Unauthorized access via compromised credentials |
| Treatment | Reduce, with the measures multi-factor authentication and an authorization concept |
What lives in the ISMS module and what lives in Ariadne
The ISMS module covers the operational part. The documents and procedures of your management system stay in Ariadne. This is where you maintain what:
| In the ISMS module | In Ariadne | In your organization |
|---|---|---|
| Information with security and privacy classification | Statement of Applicability (SoA) via the standard mapping | Operational implementation of measures in your own task tool |
| Business processes with BIA | Information security policies | Decision on risk acceptance |
| Assets and dependencies | Process “Report a security incident” | Appointing and maintaining roles |
| Derived required protection | BCM plans, training records, NIS-2 reporting obligations | – |
| Risks, treatment, reassessment | – | – |
| Measures with status and documents | – | – |
| Dashboards with risk landscape and trends | – | – |
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article