“Rapid” implementation of an ISMS for the NIS2 Directive from October 2024?
Reliably introducing an ISMS, including its certification, can easily take 15 to 36 months. That is why you should start today.
Do I need an ISMS?
Roughly speaking, from 50 employees and €10 million in turnover you should actively find out whether you will soon have to introduce an ISMS under the new Section 30(1) and Section 31 of the draft bill amending the German BSI Act from 17 October 2024.
In his July article “NIS-2 Directive”, my colleague Markus Vatter explained in detail who is expected to be subject to this obligation. Not much will change, because it is already largely determined by the EU NIS2 Directive 2022/2555.
But there are other reasons to keep information security actively maintained over the long term.
- On 3 July 2024, the EU Supply Chain Directive (2024/1760) came into force. In addition to the German Supply Chain Act (LkSG), it is gradually leading large companies to have their business partners, whether customers or clients, certified already today in order to meet their own evidence requirements. We are currently seeing our customers being asked more and more often by their business partners about ISO 27001, TISAX (automotive industry) and so on.
- Finally, an ISMS is part and an expression of functioning quality management. This means that your D&O, cybersecurity or liability insurance may refuse to pay for damage if you have not taken precautions with an ISMS despite recognisable risks.
Saving time through limitations
As a service provider, you can save the most time by limiting your ISMS in the first stage. You can do this qualitatively, by applying “only” BSI Standard 200-3 at first instead of ISO 27001, and quantitatively, by applying the ISMS only to your direct customer processes while excluding, for example, your internal administration.
If requirements grow in one dimension or another later on, you will already have a basis on which you can build quickly.
If you already know now that you will need more quality or quantity later, it is of course more effective to do it properly right away. But once introduced, the ISMS is a continuous, self-improving process, so an upgrade is already built in.
Implementation
Typical roadmap
- 3 to 12 months of introduction
- 12 months for the first regular PDCA cycle
- 9 months of certification
First steps
The first step, of course, is to decide that you want an ISMS and in what form. Then you should look for a competent consultant who helps you review this decision and supports you during implementation.
In other words, they will agree a roadmap with you: starting top-down, for example with an ISMS policy, the foundations are laid; then the assets are identified and classified, the structures for implementation and risk management are defined, control mechanisms are developed and finally everything is integrated into day-to-day operations.
Review cycle
Once the ISMS is “alive”, it continuously, usually once a year, runs through the cycle of planning, implementing, checking and acting (Plan, Do, Check, Act: PDCA).
Certification
After the first PDCA cycle is a good time to engage an additional, external auditor, if required, who starts the first certification process with you and your ISMS consultant. They check not only whether you have standardised everything, but also whether it is actually put into practice. Before completing the first PDCA cycle, the risk of the certification failing, and of paying twice, would otherwise be too high. It usually takes place in two steps. First, documents and operations are carefully reviewed, and then follow-up questions are asked and answered. It is usually valid for three years, during which smaller interim audits may take place.
Further reading
- My colleague Markus Vatter will be happy to advise you on introducing an ISMS.
- NIS-2 Directive
- BSI: ISO 27001 certification by the BSI
Source
This news article comes from our partner company bbg bitbase group.
