All inside your own Microsoft 365 environment

ISMS software that doesn't depend on one person, a folder or spreadsheets

One ISMS for ISO 27001, NIS2, NEN 7510 and ISO 9001: risks, controls, ownership, tasks and evidence, kept up to date and connected.
How ISOPlanner™ runs an ISMS.
Risks, controls and actions in one system
Evidence builds as you work, not the week before the audit
Ownership that's visible, not locked in one inbox
See how one ISMS covers four frameworks
Book A Demo
● ● ●
https://isoplanner.app/
Access control policy
8/10
Status
MK
Access control policy
Owner: M. Klein
Implemented
JV
Supplier risk review
Owner: R. de Wit
Implementation
RS
Incident response plan
Owner: T. Vermeer
Design
Evidence linked as owners complete their tasks

ISOPlanner™ is trusted by 600+ companies

Supporting 50+ Standards
The Management challenge

None of These Tools Are the Problem

Spreadsheets, SharePoint folders, email threads and shared documents are how most ISMS work starts, and for a while, that's genuinely enough. The strain shows up later: when risks, controls and actions live in different files with no link between them, when nobody can say who owns what without asking around, when evidence for last year's audit has to be reconstructed instead of pulled up, and when a second person needs to pick up where the first one left off.

Where They Work Well

Drafting a first policy or a first risk list
Small-scale document storage and version history
Ad-hoc communication about a single task

Where It Gets Harder

Linking risks to the evidence that proves it
Tracking ownership as things change
Keeping records audit-ready all year
Ten things an ISMS needs to keep control

The Core of Every ISMS

Scope

What the ISMS covers and what it doesn't.

Risks

What could go wrong and how likely this is.

Controls

What controls to implement and why.

Owner

Who is accountable for which part.

Action

What tasks are needed and planned.

Policies

Rules the organisation commits to.

Evidence

Proof of the actual system working or not.

Monitoring

Keeping track between formal reviews.

Audits

Regular audits and checks that still work.

Continuous Improvement

A route to fix what a review finds.

Each of these is manageable on its own. The real challenge is keeping all ten up to date, connected to each other, provable, and shared across the organisation and the right gatekeepers.
Why Software, Specifically

What Changes When All the Pieces Are Connected

Dedicated ISMS software doesn't replace the work of running an ISMS. It connects the pieces, so that work stays visible. A risk links to the control that treats it. The control links to the person accountable for it. And the evidence collects against that link as the work happens, instead of being assembled afterwards.

Structural, Not Just Stored

Risks, controls, actions and evidence are linked records, not separate files that happen to sit near each other.

Up-To-Date by Default

Status and evidence update as owners complete their tasks, so the system reflects real progress without extra manual bookkeeping.

Owned, Not Just Assigned

Every control and action has a named owner the system can prompt directly, instead of a task list one person tracks.

How ISOPlanner™ Connects Everything

From Requirement to Evidence

Requirement

A clause, an obligation, or a risk you've identified

➤

Controls

The measure that treats it, chosen on purpose

➤

Owner

An assigned person the system can prompt

➤

Action

The follow-up action that closes a gap

➤

Evidence

Linked from the owners' completed tasks

➤

Status

Visible at any time, not just before an audit

For a walkthrough of how this maps to your own process, book a demo.
Book a Demo
Where to Start

Two Common Starting Points

Building Your ISMS

You know you need structure for risks, controls, ownership and evidence, and you're deciding how to organise it before it grows into its own mess.
Start from a structured setup instead of a blank page
Assign ownership from day one
Build evidence as you go, not before an audit
See how a first ISMS gets structure ➤

Professionalising Your ISMS

Your ISMS already exists, but it lives in one person's files, spreadsheets and inbox, workable today, but hard to hand over, hard to audit quickly, and hard to scale.
Replace scattered tracking with one connected system
Make ownership survive people changing roles
Cut the manual work before every audit
See how professionalising works ➤
Where it lives

Works with the Microsoft 365 Environment You Already Use

Keep documents in the Microsoft environment your organisation already uses, while ISOPlanner™ connects them to the risks, controls and requirements they support.

SharePoint

Outlook

Teams

Entra ID

ISOPlanner™

Connects documents, tasks and identity to the risks, controls and requirements they supportVerbindt documenten, taken en identiteiten met de risico's, beheersmaatregelen en eisen die ze ondersteunenVerbindet Dokumente, Aufgaben und Identitäten mit den Risiken, Maßnahmen und Anforderungen, die sie unterstützen

Documents stay in SharePoint
Identity and access run through Entra ID
Tasks land in Outlook and Teams, where people already work
Scale when you need to

Build One ISMS, Not Four

Once your ISMS is structured, it becomes a shared compliance foundation. ISO 27001, NEN 7510, NIS2 and ISO 9001 each bring their own specific requirements, but they overlap heavily in what they expect around scope, risk, controls, ownership and evidence. A well-structured ISMS lets you manage those overlapping parts once, and map the framework-specific differences on top, rather than rebuilding the structure from scratch for each one.
ISO 27001
NEN 7510
NIS2
ISO 9001
Municipality of Waterland - The Netherlands

you want it to work the way it’s supposed to

Structure and Control meeting the BIO standard
Answered

Frequently Asked Questions

01.

What does ISMS stand for?

An ISMS, or Information Security Management System, is how an organisation manages information security deliberately instead of incidentally: what needs protecting, who is accountable, which controls are in place, and how you prove it. It safeguards confidentiality, integrity and availability through policies, a risk assessment, owned controls, and a review cycle that keeps pace with new threats. ISO 27001 is the standard that defines what it must contain.

02.

What's the difference between an ISMS and ISO 27001?

The ISMS is the system you run day to day, scope, risks, controls, owners, actions and evidence. ISO 27001 is one standard that says what that system must contain and against which it can be certified.

03.

Do I need a separate ISMS for NIS2?

No. NIS2 is a set of obligations rather than a management system standard, and its obligations are met by the ISMS you already run.

04.

Does NEN 7510 require its own management system?

No. NEN 7510-1:2024 contains the normative provisions for the management system according to ISO 27001, with healthcare additions in NEN 7510-2.

05.

What changed with BIO2?

BIO2 became legally binding on 15 August 2026 through the Cyberbeveiligingswet, and it requires an ISO 27001 ISMS by reference. BIO 1.04zv has lapsed.

06.

Is a CSMS the same as an ISMS?

No. CSMS is the term used for industrial systems under IEC 62443-2-1 and for vehicle type approval under UN Regulation No. 155. An ISMS manages information security; a CSMS covers operational technology or vehicle platforms.

07.

Can an ISMS live in Microsoft 365?

Yes. Documents are already in SharePoint and identity in Entra ID, so the ISMS becomes a management layer over records you are already producing.

08.

How long does it take to set one up?

With Instant 27001, about three months, starting from roughly 80% of the work already done.