German statutory health insurance funds (GKV) live in a very specific ISMS world:
- B3S (the industry-specific security standard) is the binding base.
- IVDB (IT-Verbund-Datenbank) is the central source for IT procedures.
- KZBV and GKV-SV run their own audit routines.
If you bring in an ISMS tool here without knowing the IVDB, you spend the first three months copying IT procedures out of the IVDB by hand.
What the IVDB Integration in SecTepe.Core Does
- CSV/Excel import: the tool reads current IVDB exports directly. It maps the fields to the internal asset and procedure model on its own.
- Conflict detection: when you import again, existing entries are merged, not duplicated. If there is a conflict, the user decides.
- Live progress view: IVDB lists are often large (500+ procedures). The UI shows how far the import has got and how many entries are new, changed or deleted.
- B3S-compliant data handling: all imported data gets a class. That way you can document B3S requirements (protection needs, owners, retention periods) right away.
- Future API link: the connector is ready for a direct IVDB API as soon as one is released. CSV import stays as a fallback.
What Changes Day to Day for the GKV
Before: three months of asset inventory in Excel. The data came from IVDB CSV files and was dumped into the ISMS tool by hand. With it came the usual Excel errors: shifted cells, broken encoding, leftover formulas.
After: three days to set up the mapping (which IVDB field goes to which ISMS asset field). The first import takes 30 minutes. Later imports run on their own.
How It Links to Other ISMS Building Blocks
- Risk module: each imported procedure gets a risk assessment task in the queue.
- Review cycle: each IVDB procedure gets a yearly review task. See review cycle management.
- Supplier mapping: procedures are linked to the right processors and third parties. This is key for Art. 28 GDPR.
- Audit export: the B3S auditor gets a ready-made report with IVDB references, protection needs and the status of each measure.
Why This Matters Beyond SHI
Other regulated sectors have the same problem: a large external data list that someone maintains and that has to get into the ISMS. Think of energy firms with IT network lists, KRITIS operators with asset registers or banks with MaRisk IT lists. You can reuse the IVDB integration as a pattern. The connector just gets new settings for each sector.
Realistic Limits
The integration saves the hours spent on inventory. It does not do the expert review for you. Protection needs, risks and measures are still work for experts. But without a clean asset list, there is no useful review. If your data source flows without friction, you win back 60–70 % of the usual effort to build an ISMS.
Conclusion
In regulated markets, sector-specific integrations decide whether people accept a tool. A GRC platform that reads IVDB CSVs cleanly and maps them in line with B3S will become standard in the GKV within a few years. If you are building an ISMS today, check this point when you choose a tool, not after you sign the contract.