Which ISMS Software Should You Choose?

Key takeaways

• The term "ISMS software" covers two separate markets: GRC and IT-Grundschutz tools built for public sector bodies, large corporate groups, and operators of critical infrastructure, and compliance automation built for organizations working toward ISO 27001 certification. Choose the wrong group and every product comparison that follows is the wrong comparison.
• Three questions settle the shortlist: does the solution have to run on-premises, is BSI IT-Grundschutz your leading standard, and is there someone in-house who owns the ISMS professionally?
• A first ISO 27001 certification costs EUR 23,000 to 49,000 in year one for organizations under 50 employees, and EUR 37,000 to 80,000 for 50 to 200 employees. The software license is rarely the largest item in that total.
• Published vendor prices are not comparable, because almost none of them state whether preparation, implementation, and certification body fees are included. As a rule they are not.

Place your own case first, then the vendors. If you need BSI IT-Grundschutz, an on-premises deployment, or a structure built for public authorities, municipalities, and subsidiaries inside a group, your shortlist belongs in the GRC group. If you need ISO 27001 certification, automated evidence, and integrations into your own systems, it belongs in the automation group. Both trade under the same search term, solve different problems, and cannot sensibly be scored against each other.

What are the two kinds of ISMS software?

Which vendor belongs to which group?

Every claim above comes from the vendor's own public website, checked on August 18, 2026. The table is sorted alphabetically and does not rank market position. For closer head-to-head comparisons see compliance management software compared and NIS2 software compared.

How do users rate these vendors on G2?

Ratings describe reputation, not verified product capability, and the sample sizes here differ by two orders of magnitude. Read the table together with the review count rather than by stars alone.

As of August 18, 2026, sorted alphabetically. The gap matters more than the ranking: none of the three vendors in the GRC group maintains a G2 profile at all. G2 maps the SaaS market, not the German GRC market, so a buyer who shortlists from review platforms never sees half the landscape. On OMR Reviews, which covers the DACH market, Kertos stands at 4.9 out of 5 from 21 reviews and carries the "Leader GRC Tools Q3/26" badge.

Three customer comments about Kertos from G2:

What does ISMS software actually cost?

The license price is one cost block among several. The table below normalizes the total cost of a first ISO 27001 certification and shows which items published vendor prices leave out.

Market benchmarks for consultant-supported projects in Germany, as of August 2026. These are not Kertos prices. No vendor reduces certification body fees. What is reducible is preparation and implementation. Full breakdown under ISO 27001 certification costs.

Who runs the ISMS, the software or your team?

This question decides project outcomes more often than feature coverage does. GRC tools assume a qualified person owns the risk analysis, the selection of controls, and audit preparation. Automation platforms reduce that requirement, but they only remove it when the vendor supplies qualified specialists alongside the software. So settle before you buy whether you will fill an internal role, purchase consulting days, or award a mandate. That choice moves the total cost more than any licensing decision.

When is Kertos not the right choice?

Kertos is not the right choice if the software has to run on-premises, because Kertos operates exclusively as SaaS on European infrastructure. Nor is it right if BSI IT-Grundschutz is your leading standard, or if you are a public authority, a municipality, or an operator of critical infrastructure that needs an open source, sovereignly operated solution. In those cases the GRC group is the factually correct answer. Kertos also does not cover PCI DSS or NIST CSF. And if you already have an experienced information security function in-house and want a documentation tool alone, you would be paying Kertos for expert capacity you never call on.

Where does Kertos fit?

Kertos sits in the automation group and combines the agentic platform KAIA with certified experts who take on external CISO and DPO mandates. The model is aimed at organizations without an ISMS function of their own: AskUI reached ISO 27001 certification in 8 to 10 weeks without external consultants. Customers report around 80 percent less manual compliance effort and up to 60 percent lower cost than traditional consulting, alongside a 100 percent audit pass rate and 98 percent customer satisfaction. Kertos is built in Germany and runs on European infrastructure.