Informationen zu Informationssicherheit, Cybersicherheit, Datenschutz und Syngenity! In einer zunehmend digitalisierten Welt sind diese Themen wichtiger denn je. Hier finden Sie aktuelle News rund um die Sicherheit Ihrer digitalen Daten.
Besuchen Sie regelmäßig unsere Seite und seien Sie immer einen Schritt voraus, wenn es um Ihre digitale Sicherheit geht.
Getting started with ISO 27001 is a challenging task for many small and medium-sized enterprises. At first glance, implementing an information security management system appears complex, time-consuming and resource-intensive. Organisations without their own...
Guidelines are an essential part of any management system. Whether information security, data protection, AI governance or quality management: a guideline should provide orientation, define expectations and support employees in making the right decisions....
Internal audits are one of the most important tools of an effective management system. They help companies to identify weaknesses at an early stage, reduce risks and continuously improve processes. Nevertheless, many an audit fails long before the actual audit report...
When it comes to ISO 27001, many companies initially think of extensive documentation, complicated requirements, and high costs. The international standard for information security management has a reputation for being complex and, above all, suitable for large...
BSI Grundschutz++ represents a consistent further development of the proven IT baseline protection and marks an important step towards modern, resilience-oriented cybersecurity governance. For many years, the classic BSI basic protection has been regarded as a reliable basis for information security in German organizations.
Audit Tips Vol. 5: Understanding controls: The purpose counts
In many companies, internal controls are carefully documented. They record who carries them out, how often they take place, which systems are used and which procedures are to be followed. These descriptions are important, but they fall short if they only describe the execution of a control. One crucial element is often missing: the reason why the control exists in the first place. Without this explanation, a control remains abstract and loses a significant part of its usefulness.
ISO 27001: Myth vs. reality – Myth 3: Risk assessment is a purely theoretical step with no practical benefit
In many organizations, the assumption persists that although risk assessment as part of ISO 27001 is a necessary documentation requirement, it offers little real added value for day-to-day activities. This step is often seen as a kind of theoretical exercise that ends in tables, evaluation matrices or abstract criteria. However, this view significantly underestimates the central importance of risk assessment. While the risk analysis merely describes which risks exist and how they arise, it is the risk assessment that turns this collection of information into an action-oriented tool.
Audit Tips Vol. 4: Audit Readiness Audit readiness is not a one-off task, but an ongoing component of effective corporate management. Nevertheless, many organizations still treat audits as an exceptional annual event. When the audit is suddenly on the doorstep, a...
Internal audit vs. external audit – why both are critical to a strong governance framework
Organizations today face a growing number of regulatory requirements, increasing security risks and ever more complex business processes. In this environment, audits play a central role in building trust, creating transparency and ensuring long-term organizational resilience. However, it is often underestimated how different internal and external audits are and what contribution both make to a robust governance framework. They complement each other in their impact and together offer companies a comprehensive view of effectiveness, security and compliance.
ISO 27001: Myth vs. reality – Myth 2: The risk assessment is just a formal audit point
In many companies, the idea persists that the risk assessment according to ISO 27001 is primarily a formal part of certification. Some organizations regard the risk assessment as a one-off mandatory task that must be completed before the audit in order to achieve certification. Once the certificate has been issued, the topic often loses attention in practice. However, this myth leads to significant misinterpretation of the standard and can compromise the effectiveness of the overall information security management system.