ISMS-Consulting

Q: How long does it take to set up an ISMS?

Typically six to twelve months. The shorter timeline assumes that your departments actively collaborate and that documentation isn’t starting from scratch. For KRITIS environments or international structures, it takes longer. The starting point, company size, and complexity of the IT landscape determine the scope.

Q: Do we need certification, or is an ISMS sufficient without it?

An ISMS is effective even without a certificate. You’ll need certification if customers, tenders, or regulations require proof. Many companies first set up a functioning system and decide on certification once operations are running smoothly.

Q: What role does abat play, and what remains our responsibility?

We provide structure, document templates, and audit assurance. Knowledge of your processes comes from your departments—that cannot be outsourced. Upon request, we can also assume the role of information security officer until you can fill the position internally.

Q: What happens after certification?

The ISMS transitions to routine operation: internal audits, management review, continuous improvement, and adaptation to new requirements. Without this ongoing operation, the system loses its effectiveness within a few months, and this will become apparent by the next audit at the latest.

Structured, compliant, and future-proof

Implementing an Information Security Management System (ISMS) is a strategic initiative that goes far beyond mere compliance. It creates transparency, reduces risks, and sustainably strengthens your company’s resilience. Depending on your starting point, company size, and the complexity of your IT landscape, implementation at typically takes between 6 and 12 months – and correspondingly longer for KRITIS environments or international structures.

With our proven “Success” implementation methodology, we guide you through all phases in a structured and practical manner – from the initial assessment to stable operation. In doing so, we take into account not only established standards such as ISO 27001, TISAX®, and IT-Grundschutz, but also current regulatory requirements such as NIS-2, KRITIS, and new challenges in the context of artificial intelligence (AI).

Our approach: Structured and agile

We combine a phase-based approach with agile elements to ensure rapid progress while maintaining a high degree of flexibility.

Prepare-Phase
Explore-Phase
Realize-Phase
Deploy-Phase
Certification / Assessment
Run-Phase

Prepare phase: the foundation for success

In the Prepare Phase , we work together to lay the foundation for the project’s success. During a structured kick-off, we define goals, roles, responsibilities, and the project plan. At the same time, we establish a shared understanding of regulatory requirements such as NIS-2 or KRITIS and their impact on your company.

Explore phase: the journey of discovery begins

Through a thorough gap analysis, we determine your company’s current level of maturity. We analyze existing processes, identify risks, and align them with relevant standards and regulatory requirements (ISO 27001, TISAX®, NIS-2, KRITIS, and AI regulations where applicable).

The result: a clear roadmap with prioritized actions.

Realize Phase: Bringing the vision to life

In this phase, your ISMS is actually implemented. This includes:

Development of policies and guidelines
Establishing a structured risk management framework, with particular consideration of AI risks
Integration of legal or regulatory requirements (e.g., reporting obligations, supply chain security)

At the same time, the ISMS is already being implemented operationally to demonstrate its effectiveness at an early stage.

Deployment Phase: Integration into the company

The ISMS is integrated into day-to-day business operations.
Key Focus Areas:

Target-group-specific training and awareness (including AI use and social engineering)
Conducting internal audits
Establishment of metrics to measure ISMS effectiveness
Management review for steering and prioritization

Certification / Assessment – Demonstration of maturity

We provide targeted preparation for external audits, e.g.:

ISO 27001 certification
TISAX® assessment
Documentation in the context of NIS-2 or KRITIS audits

You’ll not only achieve formal compliance but also pragmatic processes.

Run Phase: Operation and continuous improvement

An ISMS is not a project, but an ongoing process. During the Run Phase, your system is actively implemented and further developed.
We provide support in the following areas, among others:

Continuous Improvement Process (CIP)
Audit preparation and support
Adaptations to new regulatory requirements (e.g., NIS-2 updates, AI Regulation)

Prepare-Phase

Prepare phase: the foundation for success

Explore-Phase

Explore phase: the journey of discovery begins

The result: a clear roadmap with prioritized actions.

Realize-Phase

Realize Phase: Bringing the vision to life

In this phase, your ISMS is actually implemented. This includes:

Development of policies and guidelines
Establishing a structured risk management framework, with particular consideration of AI risks
Integration of legal or regulatory requirements (e.g., reporting obligations, supply chain security)

At the same time, the ISMS is already being implemented operationally to demonstrate its effectiveness at an early stage.

Deploy-Phase

Deployment Phase: Integration into the company

The ISMS is integrated into day-to-day business operations.
Key Focus Areas:

Target-group-specific training and awareness (including AI use and social engineering)
Conducting internal audits
Establishment of metrics to measure ISMS effectiveness
Management review for steering and prioritization

Certification / Assessment

Certification / Assessment – Demonstration of maturity

We provide targeted preparation for external audits, e.g.:

ISO 27001 certification
TISAX® assessment
Documentation in the context of NIS-2 or KRITIS audits

You’ll not only achieve formal compliance but also pragmatic processes.

Run-Phase

Run Phase: Operation and continuous improvement

An ISMS is not a project, but an ongoing process. During the Run Phase, your system is actively implemented and further developed.
We provide support in the following areas, among others:

Continuous Improvement Process (CIP)
Audit preparation and support
Adaptations to new regulatory requirements (e.g., NIS-2 updates, AI Regulation)

NIS-2, KRITIS, and AI – an integrated approach

Modern information security must bring together regulatory and technological developments:

NIS-2: Expanded requirements for risk management, incident reporting, supply chains, and governance
KRITIS: Increased requirements for availability, evidence management, and audit processes
Artificial Intelligence (AI): New risks arising from data processing, model usage, and shadow IT

We integrate these requirements directly into your ISMS – in a pragmatic, auditable, and future-proof manner.

Your added value

Structured and proven implementation methodology
Accelerators (templates, guidelines, best practices)
Combination of compliance and operational feasibility
Sustainable development rather than mere preparation for certification
Scalability for international rollouts

TISAX^® is a registered trademark of the ENX Association. The mention of the TISAX^® trademark does not imply any statement by the trademark owner regarding the suitability of the services advertised here. The exclusive responsibility for the content of the website and the services presented here lies with abat.

Our Consulting Services

ISO 27001-Consulting

The international standard ISO 27001 ensures information security in organizations such as companies, non-profit organizations or public institutions.

more about ISO 27001-Consulting

Consulting on TISAX®

We support you in developing an ISMS adapted to your company based on the requirements on TISAX® and prepare you for the assessment.

more about Consulting on TISAX®

NIS-2 Consulting

Gap analyses, implementation support, and integration of requirements into existing management systems.

more about NIS-2 Consulting

KRITIS-Consulting

KRITIS companies must implement organizational and technical measures to prevent disruptions to their critical service. We advise.

more about KRITIS-Consulting

Secure AI Deployment

Secure deployment and use of AI systems, risk assessment, and integration into existing ISMS structures.

to Secure AI Deployment

IT Resilience with ISO 27031

This ensures that your IT remains operational even in an emergency–using ISO 27031 as an operational implementation framework.

to IT Resilience with ISO 27031

FAQs

What is an ISMS?

An Information Security Management System (ISMS) is the organizational framework that a company uses to systematically manage its information risks: responsibilities, policies, risk analysis, measures, and their regular review.

How long does it take to set up an ISMS?

Do we need certification, or is an ISMS sufficient without it?

What role does abat play, and what remains our responsibility?

What happens after certification?

Our customers in the area protect

Saskia

ISMS Consultant
Bremen

For me, abat is: fun, exciting projects - great customers and colleagues packed into a respectful and trusting atmosphere with plenty of room for continuous development!