What does ISMS stand for?

An ISMS, or Information Security Management System, is how an organisation manages information security deliberately instead of incidentally: what needs protecting, who is accountable, which controls are in place, and how you prove it. It safeguards confidentiality, integrity and availability through policies, a risk assessment, owned controls, and a review cycle that keeps pace with new threats. ISO 27001 is the standard that defines what it must contain.

What's the difference between an ISMS and ISO 27001?

The ISMS is the system you run day to day, scope, risks, controls, owners, actions and evidence. ISO 27001 is one standard that says what that system must contain and against which it can be certified.

Do I need a separate ISMS for NIS2?

No. NIS2 is a set of obligations rather than a management system standard, and its obligations are met by the ISMS you already run.

Does NEN 7510 require its own management system?

No. NEN 7510-1:2024 contains the normative provisions for the management system according to ISO 27001, with healthcare additions in NEN 7510-2.

What changed with BIO2?

BIO2 became legally binding on 15 August 2026 through the Cyberbeveiligingswet, and it requires an ISO 27001 ISMS by reference. BIO 1.04zv has lapsed.

Is a CSMS the same as an ISMS?

No. CSMS is the term used for industrial systems under IEC 62443-2-1 and for vehicle type approval under UN Regulation No. 155. An ISMS manages information security; a CSMS covers operational technology or vehicle platforms.

Can an ISMS live in Microsoft 365?

Yes. Documents are already in SharePoint and identity in Entra ID, so the ISMS becomes a management layer over records you are already producing.

How long does it take to set one up?

With Instant 27001, about three months, starting from roughly 80% of the work already done.

ISO 27001 certification, structured and under control

Nine clear steps from kickoff to certificate, in about six months. Each step closes with a checklist before the next one opens, so you always know where you stand.

Put me on the Waiting list

● ● ●

https://isoplanner.app/

Access control policy

8/10

Status

Access control policy

Owner: M. Klein

Implemented

Supplier risk review

Owner: R. de Wit

Implementation

Incident response plan

Owner: T. Vermeer

Design

Evidence linked as owners complete their tasks

How Kickstart works

Four ingredients, each at the right moment

Software

Everything is in one place: your documents, risks, controls, tasks and evidence. ISOPlanner™ guides you through nine steps to the external audit and shows every owner what is expected of them.

Content

Policies, procedures, registers and training material are ready to use, written for SMEs and for Microsoft 365. You adopt the documents as they are, or deviate where you have a reason to. You never start with a blank page.

AI

You describe your organisation and what it does once. AI turns that into the documents the standard requires, such as your scope statement and your stakeholders. It also pre-fills the initial assessment and checks edited documents against the standard. You or the consultant confirm or correct.

Consultancy

The requirements in the standard are written in abstract terms. A consultant with deep ISO 27001 experience helps you translate them into what you actually need to do, at the five moments where that experience makes the difference.

Your timeline, nine steps

Start in November 2026. Certificate expected in June 2027.

This is your route if you start next month. Each step ends with a short checklist: once it is done, the next step opens. Five times along the way, your consultant joins you. Select a step to see what happens.

Step Consultant moment Depends on the certification body

0 Kickoff

1 Initial assessment

2 Risks

3 Policies

4 Action plan

5 Implementation

6 Awareness and rhythm

7 Audit day

8 External audit

Certificate Expected in

Step 4 · January 2027

Action plan

The software creates the tasks. Management decides on the resources.

Your timeline, nine steps

Where It Gets Harder

Everything is in one place: your documents, risks, controls, tasks and evidence. ISOPlanner™ guides you through nine steps to the external audit and shows every owner what is expected of them.

For a walkthrough of how this maps to your own process, book a demo.

Book a Demo

What you get

Everything in the box

One programme, one place. Software, content and people, with a guarantee on the documentation audit.

ISO 27001:2022 Content packageContentpakketContent-Paket Policies · procedures · registers · trainingBeleid · procedures · registers · trainingRichtlinien · Verfahren · Register · Schulungen

ISOPlanner™ Kickstart: the module in ISOPlanner™ that takes you step by step from kickoff to external audit.

The content package: policies, procedures, registers, templates and training material for ISO 27001:2022, with what you need to do to make each document true.

An action plan: tasks for every owner, with evidence you attach directly to the task. The recurring annual tasks are ready too.

A consultant at five moments: the kickoff, the policy day, the pre-audit check, the audit day with the internal audit, and a closing conversation after certification.

Support in between: our customer success team tracks your progress and brings in the consultant if you get stuck.

A Stage 1 guarantee: we guarantee you pass the certification body's documentation audit. More on that below.

Where to Start

Two Common Starting Points

Building Your ISMS

You know you need structure for risks, controls, ownership and evidence, and you're deciding how to organise it before it grows into its own mess.

Start from a structured setup instead of a blank page

Assign ownership from day one

Build evidence as you go, not before an audit

See how a first ISMS gets structure ➤

Professionalising Your ISMS

Your ISMS already exists, but it lives in one person's files, spreadsheets and inbox, workable today, but hard to hand over, hard to audit quickly, and hard to scale.

Replace scattered tracking with one connected system

Make ownership survive people changing roles

Cut the manual work before every audit

See how professionalising works ➤

Where it lives

Works with the Microsoft 365 Environment You Already Use

Keep documents in the Microsoft environment your organisation already uses, while ISOPlanner™ connects them to the risks, controls and requirements they support.

SharePoint

Outlook

Teams

Entra ID

ISOPlanner™

Connects documents, tasks and identity to the risks, controls and requirements they supportVerbindt documenten, taken en identiteiten met de risico's, beheersmaatregelen en eisen die ze ondersteunenVerbindet Dokumente, Aufgaben und Identitäten mit den Risiken, Maßnahmen und Anforderungen, die sie unterstützen

Documents stay in SharePoint

Identity and access run through Entra ID

Tasks land in Outlook and Teams, where people already work

Scale when you need to

Build One ISMS, Not Four

Once your ISMS is structured, it becomes a shared compliance foundation. ISO 27001, NEN 7510, NIS2 and ISO 9001 each bring their own specific requirements, but they overlap heavily in what they expect around scope, risk, controls, ownership and evidence. A well-structured ISMS lets you manage those overlapping parts once, and map the framework-specific differences on top, rather than rebuilding the structure from scratch for each one.

Answered