Automation
- The periodic tasks of the standard are scheduled automatically and remind before they are due.
- The business impact analysis (BIA) calculates the MTPD from its matrix.
- Continuity tests and pending actions are chased with their owners.
Automation, AI and full traceability for ISO/IEC 27001:2022
The CISO's command centre
ISMS-manager is not a document repository: it is a living ISMS that connects inventory, risks, SoA, documentation, audits and management review. We set it up and run it for you, on a dedicated server hosted in Europe.
-
I'm an organization
To use it in your organization
-
I'm a consultant
To offer it to your clients
- Aligned with ISO/IEC 27001
- Hosted in the European Union
- MFA and role-based access
- Fully managed, with backups
Complexity is expensive (and keeps you up at night)
-
Regulatory rigour
ISO/IEC 27001:2022 demands a level of traceability and rigour that manual processes cannot sustain.
-
Operational overload
The CISO's day goes on invisible admin work, chasing evidence and reminding owners.
-
Audit panic
Weeks of anxiety before each certification, reconciling outdated documents and scattered metrics.
The hidden risk of spreadsheets
Manual calculations: One mistake in the risk matrix invalidates the treatment.
Broken links: PDF policies disconnected from the actual Annex A controls.
No visibility: Nobody knows the real level of compliance right now.
The ISMS that works for you
More than a repository, a connected cycle: inventory, risks, SoA, documents, audits and management review feed into each other.
- Inventory
- Risks
- SoA
- Documents
- Audits
- Management review
| Area | The usual way | With ISMS-manager |
|---|---|---|
| Risk | Manual calculation in spreadsheets, error-prone. | Automatic MAGERIT 3.2 engine, recalculated from your SoA. |
| Documentation | Line-by-line human review. | AI assistance against the controls of the standard. |
| Audit | Months of preparation hunting for evidence. | Full traceability and a record of every change. |
| SoA | A static document, disconnected from operations. | The living engine that calibrates the whole system. |
The heart of the ISMS: MAGERIT 3.2 + SoA
The system does not assume your controls: it reads the real maturity of each one in the SoA and adjusts the risks. When the SoA changes, the risk changes.
-
Assets and threats
It crosses your inventory with the MAGERIT 3.2 threat catalogue, tuned to your organization, and instantly generates every risk combination.
-
Your SoA as the filter
Only the Annex A controls you have implemented mitigate: preventive ones lower likelihood and reactive ones impact, according to their maturity.
-
Effective and residual risk
Inherent, effective and residual risk calculated without spreadsheets, ready to decide the treatment.
Without an active SoA version, effective risk equals inherent risk. No illusions.
Artificial intelligence applied to ISO 27001
Your compliance copilot: the AI checks your organization's actual documents against the 93 controls of the current version of your SoA.
-
Detects the controls
When you add a policy, it proposes the Annex A controls it covers.
-
Does it cover what the standard requires?
A coverage score with the aspects covered, the ones missing and drafting recommendations.
-
Assesses each control
Brings together what every document says about a control into a single verdict.
The AI proposes and suggests. The CISO and the administrator review and approve. Included in the Advanced and Pro plans.
Unbiased governance (ISO 19011)
AI is a management tool, not an audit tool: the internal auditor does not see its scores and works with full independence on the evidence.
Less invisible work, more evidence
What you chase by hand today, the system plans, chases and records.
Audit-ready
- An audit log of every change, with previous and new values, always in Spanish.
- Version history of every document; the signature is tied to the approved version.
- Segregation of duties; authors do not approve their own documents when someone else can.
Management review (9.3)
- The quantitative inputs (incidents, audits, risks, objectives and training) are gathered automatically.
- Indicators are frozen at the moment of approval.
- The signed minutes are kept as evidence and shared with the attendees.
Two ways to work with ISMS-manager
Choose the approach that suits you. You can switch or combine both later.
For organizations
Use ISMS-manager for your own ISMS. We set up and maintain the instance; you choose the plan and control who gets access.
- Managed onboarding, nothing to install
- A dedicated server on every plan, from 5 to 50 users
- Access to consultants and training whenever you need them
For consultants
Offer ISMS-manager to your clients and guide them through implementation with one tool across all your projects.
- Manage all your clients and their instances in one place
- Spin up trial environments for demos
- List your services and hour packages in the directory
Your whole ISMS in one place
Everything you need to operate, measure and improve your management system, connected.
-
Risk management
Identify, assess and treat risks to your assets, with treatment plans and residual risk.
-
Statement of Applicability
Justify every Annex A control and link it to risks, evidence and owners.
-
Documentation
Policies and procedures with versioning, approvals and change control.
-
Audits
Plan internal audits, record findings and track corrective actions.
-
Incidents
Log, classify and manage security incidents through to closure and lessons learned.
-
Metrics
Measure ISMS effectiveness with metrics and dashboards for management review.
-
Continuity
Document continuity plans and link them to processes, assets and risks.
-
Assets
Information asset inventory with owners, classification and dependencies.
-
Tasks
Assign actions with due dates and owners, and track progress from a single view.
-
Training and awareness
Plan training and keep attendance records as evidence.
-
Connectors
External connectors that feed your indicators with data from your tools, on the Pro plan.
-
Access control
Per-user roles and permissions, MFA and logging of relevant actions.
How you'll see your ISMS
Dashboards built for management reviews and audits. Sample data.
-
SoA applicability
All 93 Annex A controls of ISO/IEC 27001:2022, by domain, with their applicability status.
-
Control maturity
The maturity level of each control, from initial to optimised, to prioritise improvements.
-
Threat analysis
Average impact and likelihood of each threat against your target risk level.
More security. Less bureaucracy. Zero panic.
-
The end of human error
Automated risk maths, anchored to operational reality.
-
Real decentralisation
Responsibilities shared among process owners and traced by the system.
-
Focus on strategy
The CISO stops chasing spreadsheets and gets back to leading.
Plans
Every plan is SaaS on a dedicated server: we operate the instance. Choose by number of users and the features you need.
Online sign-up, coming soon
We are finishing online sign-up and payments. In the meantime, write to us at info@cleariso.es and we will set up your instance or a free trial.
-
Basic
Your own server to get your ISMS going.
€150/month or €1,620 a year (−10%)
Up to 5 users
Small teams running their ISMS with a few people.
- Dedicated server for your organization
- Managed, up-to-date instance
- Your own subdomain with HTTPS
- Manual backups from ISMS-manager
- MFA and role-based access control
- Support included
-
Recommended
Advanced
More users and the AI assistant to move faster.
€300/month or €3,240 a year (−10%)
Up to 10 users
Organizations that want AI support for documentation and analysis.
- Dedicated server for your organization
- Managed, up-to-date instance
- Your own subdomain with HTTPS
- Manual backups from ISMS-manager
- MFA and role-based access control
- Support included
- Automatic daily server backup (7 days)
- AI assistant and AI help
-
Pro
Connected to your tools and your corporate directory.
€500/month or €5,400 a year (−10%)
Up to 50 users
Organizations with more users, automated indicators and their own intranet.
- Dedicated server for your organization
- Managed, up-to-date instance
- Your own subdomain with HTTPS
- Manual backups from ISMS-manager
- MFA and role-based access control
- Support included
- Automatic daily server backup (7 days)
- AI assistant and AI help
- External connectors for indicators
- Document publishing portal with LDAP access
What each plan includes
| Feature | Basic | Advanced | Pro |
|---|---|---|---|
| Users | 5 | 10 | 50 |
| Dedicated server for your organization | Included | Included | Included |
| Managed, up-to-date instance | Included | Included | Included |
| Your own subdomain with HTTPS | Included | Included | Included |
| Manual backups from ISMS-manager | Included | Included | Included |
| Automatic daily server backup (7 days) | Not included | Included | Included |
| MFA and role-based access control | Included | Included | Included |
| Support included | Included | Included | Included |
| AI assistant and AI help | Not included | Included | Included |
| External connectors for indicators | Not included | Not included | Included |
| Document publishing portal with LDAP access | Not included | Not included | Included |
Prices exclude VAT. Billing period, renewal and cancellation terms are shown before purchase.
What each plan adds
Always on a dedicated server. Each plan adds users and features to the previous one.
-
Basic plan
Dedicated server
Your ISMS-manager instance on a server reserved for your organization, managed, kept up to date, with manual backups whenever you need them. Up to 5 users.
-
Advanced plan
AI assistant
Everything in Basic with up to 10 users, automatic daily backups, and the AI assistant and AI help that guide you through documentation, controls and analysis.
-
Pro plan
Integration
Everything in Advanced with up to 50 users, external connectors that feed your indicators and LDAP access to your intranet document publishing portal.
Security comes first
A tool for managing security has to live up to it. These are some of the measures we run the platform with.
-
Two-factor authentication
Authenticator app (TOTP) or email code, with recovery codes.
-
Audit log
Every action is traced with its author, date and previous and new values.
-
Backups
On Advanced and Pro, an automatic daily backup of the whole server; on Basic, manual backups from ISMS-manager.
-
Pentesting and monitoring
Regular penetration tests and constant monitoring of the service.
Coming soon
Consultant directory
Soon you'll be able to find consultants specialised in ISO 27001, auditing, risk, continuity or training, see their services and rates, and send them a request from the platform.
Sign up as a consultantFrequently asked questions
Do I need to install anything?
No. ISMS-manager is offered as SaaS only: we create, update and maintain your instance. All you need is a browser.
How long does onboarding take?
Your instance is provisioned automatically once payment and acceptance of the terms are confirmed. On the Pro plan, the LDAP connection and the connectors are then set up with you.
Where is my data hosted?
On infrastructure located in the European Union. Processing terms are set out in the data processing agreement (DPA).
Can I change plans?
Yes. You can change plans from the customer area; the server and features adjust automatically and the price is prorated.
What happens to my data if I cancel?
The instance keeps running until the end of the paid period, and you can export your data meanwhile. If you prefer, you can delete it earlier from the customer area. When the period ends it is deleted automatically and permanently, with a record of the deletion.
What support is included?
Every plan includes support; the service level depends on the plan and is detailed in the SLA.
What are connectors?
Integrations with external tools, available on the Pro plan, that feed your ISMS indicators with operational data. They are always validated before being taken into account.
Can I hire consulting or training?
Yes. You'll be able to contact consultants in the directory. Their services are agreed directly with them.
Take control of your ISMS
Ask for a demo built around your compliance scenario and see ISMS-manager in practice, or write to us at info@cleariso.es.