ISMS – managing information security systematically
Cyber threats are everywhere today. Hacker attacks, fake emails (phishing) and viruses are just some of them. An Information Security Management System (ISMS) gives you a clear, step-by-step way to manage and protect sensitive company data. We base our work on the global standard ISO/IEC 27001.
PDCA Cycle
How SecTepe Supports Your ISMS
We cover it all, from one source. That starts with security checks and policy writing. It goes on to code reviews and compliance checks, up to forensic work.
Security Assessments
We prepare you and build awareness. We check your current security level against the rules of ISO/IEC 27001.
Risk Assessment
We find, rate and treat the information security risks in your whole company, step by step.
Policy Development
We write all the policies, procedures and records you need for an ISMS that meets ISO/IEC 27001.
Implementation
We run training and code reviews. We also put security measures in place and fit them into the way your business already works.
Audit & Certification
We run internal audits to check that your ISMS works. We guide you all the way to your ISO/IEC 27001 certification.
Continuous Improvement
After an incident, we secure the traces (forensics). We also keep your ISMS up to date as new threats and compliance rules arise.
You want to introduce an ISMS
We help you set the scope, assess risks and write the documents. Then we guide you to the certification audit under ISO 27001, BSI IT-Grundschutz or TISAX.
View ISMS consultingYou want a fixed monthly fee
Get ISMS support and cybersecurity in one package. Your costs are easy to plan, with no need to book each job on its own.
View the security flat rateHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.