ISMS software
from otris

Companies define areas of responsibility, roles, the guideline and the scope in otris isms. They also document the requirements and objectives of the information security system in the system. Once the planning and information network have been created, companies can use the ISMS solution to record their asset structure and asset inventory.

Both primary assets (business processes and activities as well as associated information) and supporting assets (e.g. hardware and software, networks, employees, buildings) are taken into account. The system integrates an easy-to-use documentation module for asset recording: Responsible employees describe selected assets according to predefined criteria. They group related assets and add relationships to other assets. The otris Information Security Management System then automatically creates a network plan from the asset inventory. This helps you to view individual assets or asset groupings throughout the entire process and to identify relationships. The asset documentation as an information network and the associated network plan form the basis for subsequent modelling and risk analysis in accordance with the relevant standards, such as the BSI or ISO series.

Based on the risk analysis and assessment, companies derive appropriate measures for risk treatment and develop a holistic security concept. otris isms supports both the quantitative rating according to ISO and CISIS12® as well as the qualitative rating according to BSI.

The international ISO standard specifies reference measures (from Annex A of the standard). Companies define specific hazards and categorise their impact on the necessary protection requirements. Risk scenarios are recorded, the risk is assessed accordingly and actions are derived. The BSI basic protection catalogue, on the other hand, provides typical hazards that have already been rated and in some cases provided with recommended measures. Users can carry out the basic protection check individually according to protection requirement levels. otris isms has an integrated list of all hazards in the basic protection compendium and automatically assigns the measures recommended by the BSI. A separate risk analysis is only necessary for increased protection requirements. The subsequent success control and monitoring of the implementation of measures and achievement of objectives round off the security concept. Of course, otris isms can also be expanded to include your own measures and risk catalogues.

otris isms supports you in the preparation and implementation of certification processes as well as internal and external audits. The software includes catalogues for ISO/IEC 2700x, VDA ISA (V 5.1), B3S and the CISIS12^® series. The information security management system can also be expanded to include individual, industry-specific regulations and is multi-standard capable (several standards can be applied and verified at the same time).

The required data is collected directly from the responsible persons via questionnaires, which you can create yourself, and automatically imported. otris isms offers you management-orientated reports at the touch of a button. This not only saves you time, but also creates greater transparency and measurability. The system shows you the actual status and deviations from the target status. Monitoring compliance, continuous improvement throughout the entire ISMS process and adapting to newly identified risks are crucial for controlled information security throughout your organisation. An intuitive management cockpit provides a detailed overview of which employees have which roles and responsibilities within the security concept and whether they have reliably completed their assigned tasks. The cockpit also shows internal and external audit results as well as the current status of risk management.

An Information Security Management System (ISMS) is a structured system for managing information security in an organisation. It includes policies, processes and controls tomanage information risks and protect sensitive data from threats such as cyber attacks and data loss.

An ISMS offers companies the following advantages:

• Reduction of information security risks: Systematic identification and minimisation of security risks
• Compliance with legal requirements: Compliance with relevant legal and regulatory requirements.
• Increasing process stability: Integrating information security into business processes to avoid interruptions.
• Avoiding security incidents: Early detection and prevention of security incidents.
• Continuous improvement: Regular review and adjustment of security measures.
• Certification benefits: Increased trust among customers and partners as well as competitive advantages through proof of high security standards.

An ISMS protects all types of information, including personal data, and thus supports compliance with data protection requirements such as the General Data Protection Regulation. It integrates data protection into general security management and does not treat it in isolation.

The software makes the certification process considerably easier by supporting the creation and management of the necessary documentation, the performance of internal audits and the implementation of security measures in accordance with the requirements of ISO 27001.

otris isms is flexible and can be customised to a company’s specific requirements and existing systems. It offers interfaces for integration with other IT systems, enabling seamless implementation and management.