From Asset Data to ISMS Insights
ISMS Software Based on Your CMDB
An information security management system (ISMS) is only as good as the data on which its risk assessments are based. DataGerry connects your ISMS directly to your asset and service documentation. Risks are not assessed theoretically in spreadsheets, but where they actually arise: at the level of systems, services, and their interdependencies. Measures, responsibilities, reports, and audit evidence all come from a single database.
What is an ISMS?
An Information Security Management System (ISMS) is a systematic approach that an organization uses to protect its information. It establishes rules, roles, and processes to identify, assess, and address risks with appropriate measures, and regularly reviews their effectiveness. An ISMS also serves as the foundation for ISO 27001 certification and for compliance with NIS 2 requirements.
What are some common challenges in implementing an ISMS?
In many companies, the ISMS is managed using Excel spreadsheets that have long since become out of sync with the actual IT inventory. If a server is missing from the list, it is also missing from the risk analysis. In addition, there are other typical hurdles:
- Outdated asset lists:
The inventory is maintained manually and lags behind changes in IT. - Risks without context:
Assessments are listed in isolation in spreadsheets; dependencies between systems and services remain invisible. - Unclear Responsibilities:
It is not clearly defined who assesses a risk and who bears it. - High effort required before audits:
Evidence must be gathered from various sources each time. - Data silos:
The CMDB, ticketing system, vulnerability scanners, and ISMS operate alongside one another rather than in tandem.
The Solution: DataGerry as ISMS Software
DataGerry solves these problems at their root: The ISMS uses the same data as your CMDB. If an asset, an owner, or a dependency changes, that change is immediately reflected in the risk assessment.
Your Benefits at a Glance
- A single database instead of siloed solutions: Assets, services, risks, and measures are all managed within a single system.
- Risks in context: Each assessment is tied to the relevant asset or service—including dependencies.
- Clear accountability: Assessors and risk owners are clearly assigned.
- Audit-ready: The audit trail provides a complete record of who changed what and when.
- Open and integrable: Integration with ITSM, SIEM, vulnerability scanners, and GRC tools via OpenCelium.
5 Steps to an Effective ISMS
1. Create transparency
An ISMS is only effective once it is clear “what” needs to be protected and “who” is responsible for it. DataGerry links the ISMS directly to the CMDB database—for example, to assets, services, owners, and dependencies.
2. Assess risks where they arise
Risks are assessed directly against assets and asset groups—not in isolated tables.
• Probability & Impact → automatic risk calculation and presentation in a risk matrix
• Roles → clear assignment of valuation (valuator) and responsibility (owner)
• Audit Trail → traceable record of who changed what and when
3. Putting Standards into Practice
CMDB and risk assessments form the basis for a structured and verifiable documentation of requirements:
• Transparency and accountability regarding assets/services
• Risk and countermeasure management
• Identification of critical services and dependencies
• Basis for BIA and emergency/recovery planning
Ensuring Transparency
Assessing risks where they arise
Putting standards into practice
Make critical service chains visible
Integrate into the toolchain
4. Identifying Critical Service Chains
By visualizing dependencies, it becomes immediately clear which services are affected if component X fails. This improves prioritization, communication, and action planning.
5. Integrate into the toolchain
The data is enriched and securely transmitted via the integrated API platform (OpenCelium)—for example, to: ITSM/ticketing, SIEM/SOC, vulnerability scanners, IAM/NAC, and ISMS/GRC.
ISMS as the Basis for ISO 27001 and NIS2
A well-structured ISMS serves as the common foundation for certifications and legal obligations. With DataGerry, you manage assets, risks, and measures just once and use them simultaneously for:
- ISO 27001: Asset inventory, risk treatment, and audit evidence for certification. → Learn more about ISO 27001 with DataGerry
- NIS2: Risk management, supply chain security, and reporting capabilities for affected organizations. → Learn more about NIS2 implementation with DataGerry
- BSI IT-Grundschutz++: The BSI’s modernized IT-Grundschutz relies on leaner, machine-readable requirements. DataGerry provides the structured asset and service foundation to which these requirements can be directly linked.
For more information on the interplay between NIS2, ISO 27001, and Grundschutz++, please see our free white paper.
Are you ready to take control of your data?
Start your 14-day free trial of DataGerry today.
Try DataGerry, the open-source CMDB that brings structure and flexibility to your IT documentation. Discover powerful features, automate your workflows, and gain a complete overview of your assets—with no obligations.
FAQ – DataGerry ISMS
Please feel free to contact us
Contact the DataGerry team
Do you have any questions, or are you facing a particular challenge?
Our dedicated DataGerry team would be happy to assist you.
Office Address
Hauptstraße 8b, 82008 Unterhaching, Deutschland
Email
info@datagerry.com
Phone
+49 89 608668 0
Follow us on