Everything an ISMS needs. Nothing more.
More than 20 modules, logically linked to one another. Each fulfils a clearly defined task, from the information security policy to the audit. Modules marked “Advanced” are included in the Advanced edition.
Binding rules, properly approved.
Policies, guidelines and objectives form the foundation of your ISMS. WolfISMS keeps them up to date, versioned and accessible to everyone.
Documents
Write policies, concepts and evidence directly in the editor or bring them into the system via Word import. Every document goes through review and approval, and every change creates a new version with a change log. Export to Word or PDF with a table of contents on your letterhead.
Your benefit: No more “final_v3_new.docx”: there is always exactly one valid version, and the auditor can see at a glance who approved it and when.
Policy portal
Approved policies are available to all employees in a dedicated portal. In a read-and-acknowledge matrix you define which role must know which document. Acknowledgements are confirmed and evaluated, and outstanding ones are followed up by email reminders.
Your benefit: You always know who knows the rules, and you have the evidence required by ISO 27001 clause 7.3 without signature lists.
KPIs & objectives Advanced
Business objectives, the scope of the ISMS and the security objectives derived from them, all in one place. Every KPI gets a target value, and every measurement is stored as history, never overwritten.
Your benefit: You show not only that you have objectives, but how they are developing. The values feed directly into the management review.
Management review Advanced
Guides you through all inputs required by ISO 27001 clause 9.3.2. Open critical risks and the status of KPIs are shown live, and agreed actions are created and linked directly. Export to PDF or PowerPoint.
Your benefit: The annual review for top management is prepared in one session instead of being pieced together over days.
From asset to assessed risk.
WolfISMS connects assets, threats and vulnerabilities and calculates criticality and risk score from your assessments.
Asset management
Record information, applications, systems and infrastructure according to the OBASHI model and rate them for confidentiality, integrity, availability and authenticity. Criticality is calculated, and protection requirements are inherited along the dependencies. Recovery objectives (RTO, RPO, MTPD) and GDPR details sit right on the asset.
Your benefit: One inventory instead of many lists: what you maintain here is automatically used by risks, BCM, the access matrix and vulnerabilities.
Risk management
Identify risks, link them to assets, threats and vulnerabilities and assess them before and after treatment. The risk matrix and average score show the situation at a glance, and the trend is recorded daily.
Your benefit: Assessments follow the same logic everywhere, and you can see immediately which measure actually reduces the risk.
Vulnerability management Advanced
Record vulnerabilities with CVSS score, source and status, assign owners and link them to assets, risks, incidents and measures. Scanners can deliver their findings via the REST API if you wish.
Your benefit: Findings from scans and penetration tests do not disappear into PDF reports; they are tracked until they are fixed.
Access matrix Advanced
Define the target permission for every asset and every role, from “no access” to emergency access, with justification, approver and next recertification date. Export and import as Excel in the ISO 27001 layout.
Your benefit: Access reviews under A.5.18 become plannable, and deviations from the need-to-know principle stand out.
Turning the plan into everyday practice.
Measures, deadlines and recurring tasks come together, with reminders and a complete chain of evidence.
Measures
Every measure has an owner, a deadline and a status, and is linked to the risks, controls, audit findings and incidents it stems from. If you wish, it is handed over to your ticketing system.
Your benefit: For every task it is clear why it exists, and for every risk what is being done about it.
Operational plan Advanced
Plan recurring duties such as backup tests, access reviews or emergency drills at fixed intervals. Completed runs are archived immutably, and the next date is created automatically.
Your benefit: Nothing is forgotten, and the complete chain of evidence for the audit builds up along the way.
Change management
Change requests with implementation, test and rollback plans, approval by a change board in up to three stages, a change calendar and a post-implementation review. Every status change is logged.
Your benefit: Changes are controlled in line with A.8.32 without you needing a separate ITSM tool.
Tasks & deadlines
“My tasks” bundles everything that is due for a user: measures, reviews and checks from all modules. Reminders arrive as a single email digest, and during absences the deputy can see the tasks too.
Your benefit: Everyone knows in the morning what needs to be done, without clicking through modules.
Security does not end at your own firewall.
Employees, service providers and emergency contacts are part of the ISMS. WolfISMS maps roles, training and the supply chain.
Personnel management Advanced
A staff directory with reading status per employee, training sessions with participant management, and guided onboarding and offboarding with a checklist for access rights and equipment. The awareness report shows outstanding acknowledgements per department and person.
Your benefit: No access is forgotten when someone leaves, and training evidence for clauses 7.2 and 7.3 is available at the push of a button.
Supplier management
Manage suppliers with type, classification and evidence, calculate their risk from likelihood and impact, and link them to assets, measures and incidents. A security questionnaire based on ISO 27001 and NIS2 is sent to the supplier via a link, and the answers feed into the assessment. For cloud services, an exit strategy belongs in the file.
Your benefit: The supply chain security required by NIS2 is structured instead of scattered across emails.
(Emergency) contacts Advanced
Employees, service providers, authorities, interested parties and customers in separate directories, including the bodies that must be informed in the event of an incident.
Your benefit: When it matters, nobody has to search for phone numbers.
Reporting Advanced
All reports and exports of the ISMS on one page, organised by their role in ISO 27001: from the Statement of Applicability and risk and awareness reports to audit and exercise reports.
Your benefit: When the auditor asks for evidence, you have it in seconds.
Prepared when things get serious.
What matters is how quickly and how systematically you respond to incidents and restore operations.
Incident management
Record, classify and handle incidents, with root cause analysis, improvement measures and links to assets, risks and suppliers. The reporting assistant checks reporting obligations under NIS2, GDPR and the CRA, shows the running deadlines and provides pre-filled notification texts.
Your benefit: Even under time pressure you will not miss a 24- or 72-hour deadline, and every notification is documented.
Playbooks Advanced
Store and describe agreed response plans for typical incidents such as ransomware, phishing or data loss in one central place.
Your benefit: In an emergency the team follows agreed steps instead of improvising.
BCM Advanced
Business impact analysis per asset, emergency plans with version and validity, and emergency exercises with results, lessons learned and follow-up actions. Exercise reports as PDF.
Your benefit: You know which systems need to be running again and how quickly, and you can prove that your plans work.
Information security in project management Advanced
Record projects with their security requirements and link them to risks, measures and documents, as required by ISO 27001 A.5.8.
Your benefit: Security is planned in from the start, not bolted on afterwards.
Audits without hunting through folders.
Standards, laws and contracts in one place, with the evidence for auditors close at hand.
Standards & controls
ISO 27001, NIS2, BSI IT-Grundschutz, GDPR and the CRA with all requirements. Every control shows its implementation status and the linked documents, measures and evidence. WolfISMS generates the Statement of Applicability (SoA) from this automatically.
Your benefit: One piece of evidence covers several standards, and the SoA is always up to date instead of being laboriously updated once a year.
Legal register Advanced
Legal and contractual requirements with subject area, relevance, owner, measure, document reference and due date, as required by ISO 27001 A.5.31.
Your benefit: You keep track of which obligations apply to you and how you meet them.
Audits Advanced
Plan internal and external audits as well as gap assessments. The requirements of a standard are imported as a checklist and assessed individually, and the degree of fulfilment is calculated. Nonconformities are created from the checklist item with one click, with root cause analysis and effectiveness review according to clause 10.2. An assistant guides you step by step through the gap analysis.
Your benefit: From the audit plan to the closed nonconformity, everything stays in one tool, including the audit report as PDF.
The foundation every auditor wants to see first.
Organisation, processes and networks are held in the system as graphical maps rather than loose files. They draw on the same data as assets, risks and measures and therefore stay up to date automatically.
Organisation chart
The organisational structure as a drag-and-drop graphic, with management, employees and the assets, risks and measures of each department.
Process map
Management, core and support processes on one map, with owners and process documents. You model BPMN diagrams directly in the tool.
Network zones
Network segmentation from external networks to the high-security zone, with VLANs, address ranges and owners.
Plans & registers
Storage for network plans, process diagrams (including draw.io) and asset registers with status and version.
Sign in as usual. Data flows by itself.
With the SSO & REST API add-on, WolfISMS fits into your existing IT: your employees sign in with their company account, and your systems exchange data directly with the ISMS.
Single sign-on with Microsoft and Google
Your employees sign in with the account they already use. No extra password, no duplicate user administration.
- Sign-in via Microsoft Entra ID (Microsoft 365) or Google Workspace
- Your sign-in rules such as multi-factor authentication also apply to WolfISMS
- Anyone blocked in the directory can no longer get in via SSO either
REST API for your systems
External systems create or read incidents, measures, assets, risks, suppliers and vulnerabilities. Typical integrations:
- The SIEM reports security events automatically as incidents
- The ticketing system takes over open measures and writes the ticket number back
- The vulnerability scanner delivers findings, and the treatment status flows back
- The CMDB reconciles the asset inventory, ERP or purchasing report new suppliers
- Reporting tools read risks and inventory for the management report
Every connected system receives its own API key. WolfISMS stores only a hash of it, and a deactivated key is rejected immediately. The detailed interface description is available on request. SSO & REST API can be booked as an add-on to Essentials and Advanced; you will find the prices under Pricing & editions.
Fits into your IT landscape.
SSO & REST API
Sign-in via Microsoft or Google, integration of SIEM, ticketing system, CMDB and ERP (add-on).
Self-hosted with Docker
On premises or in your own cloud, on any Linux base.
Cloud in Germany
Operated by us on servers in Germany, with the option to switch to on-premises at any time.
Admin interface for consultants
Create, update and back up several customer environments centrally.
See the modules in action.
In a demo, we show you WolfISMS based on your own questions.