Managed ISMS: your ISMS runs, even without an ISMS team
We run your ISMS: as the ISMS lead on your behalf, as the PMO for your security programme and with AI agents that handle the routine work. You decide, we take care of the rest.
When you have no ISMS team of your own
- Customers, authorities or NIS2 require a working ISMS, but nobody in-house has time for it.
- One person handles information security on top of their actual job and cannot keep up.
- The ISMS exists, but nobody maintains it between audits.
What we take over
ISMS lead and PMO
Monthly ISMS meeting, action plan with deadlines, KPIs and a report to management.
Risks and controls
Risk assessment every year and after changes, treatment plan, Statement of Applicability kept up to date.
Policies and evidence
Maintain policies, request and review evidence. The Evidence Review agent does the routine.
Suppliers (TPRM)
Assess critical suppliers, send and evaluate questionnaires, track the risks on the platform.
Awareness
Annual campaign for your staff, with a phishing simulation if you wish.
Incidents and emergencies
Incident coordination, reporting process under the Information Security Act (24 hours to the BACS), annual exercise.
Audit and review
Prepare the management review, support customer and certification audits.
AI agents in operation
We set up the agents, monitor them and review their results before anything is approved.
Do it yourself, together or by us
| Swiss GRC Hosting | GRC as a Service | Managed ISMS | |
|---|---|---|---|
| Your own GRC platform in Switzerland | ✓ | ✓ | ✓ |
| Setup and data migration | – | ✓ | ✓ |
| Platform operation and support | ✓ | ✓ | ✓ |
| AI agents | optional | optional | included |
| Run ISMS processes (risks, evidence, suppliers) | – | – | ✓ |
| PMO and reporting to management | – | – | ✓ |
| Audit support | – | optional | ✓ |
Three packages, one fixed monthly price
Up to 50 employees, one standard (e.g. ISO 27001 or NIS2)
- 8 hours of support per month
- 3 agents: Evidence review, Control review, Risk analysis
- Quarterly report to management
50 to 250 employees, ISO 27001 or NIS2
- 16 hours of support per month
- All 6 agents
- Monthly report to management
- Audit support
Several sites or standards (e.g. ISO 27001, NIS2, ISO 42001)
- 32 hours of support per month
- All 6 agents
- Monthly report and steering committee
- Audit support
Platform, agents and support for one fixed monthly price. Additional effort by agreement. Minimum term 12 months. Quote within one working day.
What stays with you
Your management decides
Accepting risks, putting policies into force and approving resources stays with you. We prepare every decision.
Independent internal audit
Whoever runs the ISMS does not audit it. An independent person or partner carries out the internal audit. Certification bodies check this too.
One fixed contact
You work with one person who knows your ISMS and can reach us directly.
How to start
Initial consultation
We clarify scope, standards and goals.
Gap analysis and setup
Baseline, platform, data, agents. Fixed price per quote.
Ongoing operation
Monthly rhythm with meeting, actions and report.
Annual cycle
Risk assessment, management review and audit.
Frequently asked questions
Does Managed ISMS replace an information security officer?
We take over the tasks of the ISMS lead on your behalf. Responsibility for decisions stays with your management.
Can we get ISO 27001 certified with Managed ISMS?
Yes. We prepare and support the audit. The internal audit must be independent; we organise it with a partner.
How is this different from GRC as a Service?
With GRC as a Service we set up and run the platform and your team does the ISMS work. With Managed ISMS we take over that work too.
Where is our data?
Platform, AI agents and data stay in Switzerland, in an ISO 27001 certified data centre.
How long is the contract?
At least 12 months, then renewable each year. We adjust the scope as needed.
Your ISMS runs, even without an ISMS team.
We will prepare a quote for the right package.