ISO/IEC 27001:2022
Implement ISO 27001 with Software That Truly Understands Your Assets
To obtain ISO 27001 certification, you must demonstrate that you understand your information assets, systematically assess risks, and effectively implement controls. DataGerry integrates asset inventory, risk assessment, and controls into a single database so that your audit is based on facts rather than Excel spreadsheets.
What is ISO 27001?
ISO/IEC 27001 is the internationally recognized standard for information security management systems (ISMS). Chapters 4 through 10 describe the requirements for establishing, operating, and continuously improving an ISMS. Appendix A of the current 2022 version contains 93 controls in four subject areas: organizational (37), personnel-related (8), physical (14), and technological (34).
Why Use a CMDB-Based ISO 27001 Tool?
Many ISMS tools manage policies and controls but lack insight into the actual IT environment. The asset inventory is then maintained separately and quickly becomes outdated—a common finding in audits. DataGerry turns this around: The risk assessment is based on the CMDB, which already maps your IT infrastructure and keeps it up to date via interfaces.
ISO 27001 as the Basis for NIS2
Organizations that operate an ISMS in accordance with ISO 27001 already meet a large portion of the NIS2 requirements for risk management. With DataGerry, you can use the same data for both.
The Path to ISO 27001 Certification
1. Define the scope of application
Define which locations, organizational units, processes, and systems are covered by the ISMS. In doing so, take into account the requirements of customers, regulators, and other interested parties (Chapter 4). A clearly defined scope helps keep effort and audit costs under control.
2. Create an asset inventory
Capture all information assets within the scope—from servers and applications to cloud services and service providers—and assign an owner to each one (Annex A 5.9). In DataGerry, you can build the inventory in the CMDB or import existing data, automatically mapping the dependencies in the process.
3. Assess Risks
Define a standardized method and assess threats and vulnerabilities based on probability and impact (Chapter 6.1.2). In DataGerry, the assessment is performed directly on the asset; the risk is calculated automatically and displayed in a risk matrix.
4. Managing Risks
For each risk, decide whether to mitigate, avoid, transfer, or accept it (Chapter 6.1.3). Compare the selected measures with the 93 controls in Appendix A and explain in the Statement of Applicability (SoA) which controls you apply and which you do not.
5. Implement and document measures
Assign a responsible person and a deadline to each action item, and track the implementation status. In addition, create the required guidelines and documents. The audit trail in DataGerry shows at any time who changed what and when.
6. Internal Audit and Management Review
Before the certification audit, conduct an internal audit to verify that the ISMS meets the requirements and is effective (Chapter 9.2). Management then evaluates the results (Chapter 9.3). Address any nonconformities with documented corrective actions (Chapter 10).
7. Certification Audit
In Stage 1, an accredited certification body reviews your documentation, and in Stage 2, it assesses the effectiveness of the ISMS in practice through interviews, spot checks, and supporting documentation. The certificate is valid for three years; annual surveillance audits are conducted during this period, followed by a recertification audit.
DataGerry supports steps 2 through 6 and keeps the data up to date afterward, so that compliance audits don’t turn into major projects every year.
How does DataGerry help with the implementation of ISO 27001 requirements?
| ISO 27001 Requirement | How DataGerry Supports This |
| Appendix A 5.9 – Inventory of Information and Associated Values | Complete, up-to-date asset inventory in the CMDB, including owners |
| Annex A 8.9 – Configuration Management | Configurations of systems and services are documented centrally and are traceable |
| Chapter 6.1.2 / 8.2 – Risk Assessment | Assess risks directly at the asset level, automatic calculation, risk matrix |
| Chapter 6.1.3 / 8.3 – Risk Treatment | Assign Measures to Risk Owners and Status |
| Annex A 5.19–5.22 – Supplier Relationships | Record suppliers and link them to dependent services |
| Annex A 5.24–5.28 – Handling Security Incidents | Immediately identify affected services based on dependencies; SIEM and ticketing integration |
| Annex A 5.30 – ICT Readiness for Business Continuity | Identify Critical Services as the Basis for BIA and Emergency Planning |
| Annex A 8.8 – Management of Technical Vulnerabilities | Integration of Vulnerability Scanners, Mapping to Affected Assets |
| Chapter 7.5 / 9.2 – Documented Information and Internal Audit | Audit trail and reports as evidence for auditors |
ISO 27001 Requirement: Appendix A 5.9 – Inventory of Information and associated valuesHere’s how DataGerry helps: Complete, up-to-date asset inventory in the CMDB, including owners
ISO 27001 Requirement: Annex A 8.9 – Configuration Management
Here’s how DataGerry supports: Configurations of systems and services centrally documented and traceable
ISO 27001 Requirement: Chapter 6.1.2 / 8.2 – Risk Assessment
Here’s how DataGerry helps: Risks directly to assets , automatic calculation, Risk matrix
ISO 27001 Requirement: Chapter 6.1.3 / 8.3 – Risk Treatment
Here’s how DataGerry helps: Measures with Risk Owner and Status Assign
ISO 27001 Requirement: Annex A 5.19–5.22 – Supplier Relationships
Here’s how DataGerry supports: Suppliers Record and with related services link
ISO 27001 Requirement: Annex A 5.24–5.28 – Handling of Security Incidents
Here’s how DataGerry helps: Those affected Services via Dependencies immediately ; SIEM- and ticketing integration
ISO 27001 Requirement: Annex A 5.30 – ICT Readiness for Business Continuity
Here’s how DataGerry helps: Critical services Identify as basis for BIA and emergency planning
ISO 27001 Requirement: Annex A 8.8 – Management Technical vulnerabilities
Here’s how DataGerry helps: Integration of vulnerability scanners, Mapping to affected assets
ISO 27001 Requirement: Chapter 7.5 / 9.2 – Documented Information and internal audit
Here’s how DataGerry helps: Audit Trail and Reports as evidence for auditors
DataGerry as the Basis for ISO 27001 and NIS2
A well-structured ISMS serves as the common foundation for certifications and legal obligations. With DataGerry, you manage assets, risks, and measures just once and use them simultaneously for:
- ISO 27001: Asset inventory, risk treatment, and audit evidence for certification. → Learn more about ISO 27001 with DataGerry
- NIS2: Risk management, supply chain security, and reporting capabilities for affected organizations. → Learn more about NIS2 implementation with DataGerry
- BSI IT-Grundschutz++: The BSI’s modernized IT-Grundschutz relies on leaner, machine-readable requirements. DataGerry provides the structured asset and service foundation to which these requirements can be directly linked.
For more information on the interplay between NIS2, ISO 27001, and Grundschutz++, please see our free white paper.
Are you ready to take control of your data?
Start your 14-day free trial of DataGerry today.
Try DataGerry, the open-source CMDB that brings structure and flexibility to your IT documentation. Discover powerful features, automate your workflows, and gain a complete overview of your assets—with no obligations.
FAQ – ISO 27001 with DataGerry
Please feel free to contact us
Contact the DataGerry team
Do you have any questions, or are you facing a particular challenge?
Our dedicated DataGerry team would be happy to assist you.
Office Address
Hauptstraße 8b, 82008 Unterhaching, Deutschland
Email
info@datagerry.com
Phone
+49 89 608668 0
Follow us on