ISMS Managementin one platform
SecTepe.Core puts each part of your ISMS in one place: assets, risks, policies, controls and audits. Each item has versions and links to the rest. So you are ready for an audit at any time.
What you get
- Asset lifecycle
- Risk register with CVSS
- Policy repository
- Control monitoring
- Audit workspace
- Evidence linking
Features at a glance
Each part of your ISMS in one platform, from the first asset to the audit.
Asset Lifecycle Management
Record, classify and track each asset over its whole life. That runs from the day you buy it to the day you retire it.
Risk Register
One central risk register with CVSS scores and a heat map. Treatment plans name an owner. The risk owner signs off on changes.
Policy Management
Write, approve, publish and revise policies, with versions. Read receipts show who has read and confirmed them. Fixed review cycles show when the next review is due.
Control Tracking
See how each control works in daily use. Each one has a status, an owner, evidence and fixed review dates. Reminders go out by themselves.
Audit Collaboration
Auditors, consultants and your own teams work in one shared space. It holds tasks, comments, chat and a store for evidence.
Reporting & KPIs
Dashboards for managers, auditors and the ops team show KPIs and trends for risks, controls, policies and audits. You can export them.
Your benefits
Too many separate tools slow your ISMS down. SecTepe.Core brings each module into one platform. Your team spends less time switching tools and more time on security.
- One source of truth for assets, risks and controls
- Linked data: evidence, risks and controls point to each other
- Ready for audits, with full versions and history
- Less manual work thanks to reminders and set workflows
- Clear dashboards for managers and auditors
Use cases
ISO 27001 operations
Run your ISMS day to day in one tool: plan, do, check, act. It spans risk treatment all the way to the management review.
Risk treatment plans
From each risk you identify, you derive measures. Core tracks them until they are done.
Rolling out new policies
Roll out new policies across the company. Staff confirm them online, and a report shows the status.
Internal and external audits
Auditors get their own workspace with evidence, controls, documents and the history. No more back-and-forth by email.
How ISMS Management works in practice
SecTepe.Core keeps assets, risks, controls and policies in one database. Records point to each other. So you can trace a risk back to the asset it affects. You also see which controls treat it.
How the building blocks fit together
- Assets have a type, an owner and a custodian. You rate confidentiality, integrity and availability from 1 to 5. From these values, Core works out how critical the asset is overall.
- Risks get a likelihood and an impact from 1 to 5. Core calculates the risk level. You decide: reduce, transfer, avoid or accept. Residual values show the state after treatment.
- Controls carry an ISO 27001 reference, a type and a status. You can load the ISO 27001 Annex A catalog in German or English.
- Policies move from draft to review to approved. Core keeps every version. Staff confirm or decline the policies assigned to them.
Typical scenarios
- ISO 27001: Load Annex A and mark each control as applicable or not, with a reason. Then export the Statement of Applicability (SoA) to PDF, Excel or Word.
- BSI IT-Grundschutz: For each risk, you pick ISO 27005 or BSI 200-3 as the method. With BSI 200-3 you link a threat from the BSI catalog and set the protection need. Assets also get suggestions from that catalog.
- Internal audits: On request, Core drafts a three-year ISO 27001 audit program.
- Reviews: Each policy has a review cycle, 12 months by default. Overdue reviews appear in their own list.
Operation and data sovereignty
You can host SecTepe.Core yourself. It runs in containers on your own servers or on Kubernetes. It also runs in networks with no internet access. Each record belongs to exactly one tenant. The AI runs at IONOS in German data centers, on SecTepe GPU servers or on your own GPU server. Core will not start if any other AI provider is set.
Common questions
Who can change a risk? Anyone with the right role can propose a change. If that person is not the risk owner, the change waits. It only takes effect once the owner approves it.
What happens to the history when a risk is deleted? Core logs each creation, update, status change and deletion. It records who made the change. This history stays, even after the risk itself is gone.
Can I get my data out? Yes. Assets, risks, controls and policies each have an XML export.
Ready for integrated ISMS management?
See how SecTepe.Core makes your ISMS simpler and keeps it ready for audits at all times.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.