ISO 27001, NIS-2 and BSI IT-Grundschutz come up constantly in information security. With this overview you can quickly tell which of them is mandatory, which can be certified and which serves as guidance. You also see where Ariadne ISMS and Ariadne support you with each requirement.
The three key frameworks
NIS-2
Implemented in Germany in the BSI Act (BSIG)
Companies in scope must demonstrate risk management, even without a certificate. Management is personally liable.
Key content
- Risk management with an obligation to provide evidence
- Reporting security incidents within 24 hours, follow-up report within 72 hours
- Registration with the BSI
- Personal liability of management
ISO/IEC 27001:2022
International standard for information security management systems
The standard describes what an ISMS must achieve, not how you implement it. Clauses 4 to 10 are mandatory, plus Annex A with 93 controls.
Supporting guidance
- ISO/IEC 27002 explains the 93 controls from Annex A.
- ISO/IEC 27005 describes risk assessment and includes a threat catalog in Annex B.
BSI IT-Grundschutz
Methodology of the German Federal Office for Information Security (BSI)
IT-Grundschutz provides concrete modules and 47 elementary threats. It also has its own certification.
When does it help me?
- When you need concrete requirements for specific types of systems
- When you want to use typical threats as a starting point for risks
Quick comparison
| Framework | Type | Key content |
|---|---|---|
| NIS-2 (in the BSIG) | Mandatory | Risk management, reporting deadlines, registration, management liability |
| ISO/IEC 27001:2022 | Certifiable | Clauses 4 to 10 mandatory, Annex A with 93 controls |
| ISO/IEC 27002 | Guidance | Explanation of the 93 controls |
| ISO/IEC 27005 | Guidance | Risk assessment, threat catalog in Annex B |
| BSI IT-Grundschutz | Guidance with its own certification | Modules and 47 elementary threats |
How Ariadne ISMS and Ariadne support you
The requirements are split between two places: operational information security management runs in the ISMS module, while you maintain policies and management-level evidence in Ariadne.
| Requirement | Where you implement it |
|---|---|
| Required protection of information and processes, business impact analysis | ISMS module |
| Risk assessment, risk treatment and reassessment | ISMS module |
| Measures with status and evidence documents | ISMS module |
| Risk landscape for the management review | ISMS module Dashboard Risk management |
| Statement of Applicability (SoA) | Ariadne via the standard mapping |
| Information security policies | Ariadne |
| Reporting security incidents, NIS-2 reporting obligations | Ariadne as a process |
| BCM plans and training records | Ariadne |
Catalogs as a starting point
You do not have to start your risks and measures from scratch. For the rollout there are catalogs you can bring in via data import:
- Information catalog based on the GDPR and ISO 27001
- Risk catalog based on ISO 27005 with 206 entries in the format "threat – vulnerability"
- Measure catalog based on ISO 27001 Annex A with 93 controls
- BSI IT-Grundschutz with selectable modules
- Your own catalogs via Excel import
You then find the entries in the user menu under Risk and measure catalogs. When you create a risk or measure, you search them directly from the title field.
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article