Which ISMS and DPMS tools suit corporate groups with multiple subsidiaries?

As of October 23, 2026. The GDPR, the NIS2 Directive, Recommendation 2003/361/EC, and the German BSI Act and Federal Data Protection Act checked against the legal text on October 23, 2026; ISO/IEC 17021-1 in its 2015 edition.

Key takeaways

• An ISO 27001 certificate covers the scope stated on it, not the corporate group. A subsidiary outside that scope is not certified, even if its parent company is.
• For the NIS2 size thresholds, the headcount, turnover, and balance sheet of partner and linked enterprises generally count, because the directive applies Recommendation 2003/361/EC. A small subsidiary can be in scope because of its group.
• The GDPR has no group privilege. Every company in the group is a controller in its own right, as a rule with its own record of processing activities; Article 37(2) GDPR allows one shared data protection officer for the group.
• A tool for several entities has to separate data per entity, pass group requirements down, hold evidence per entity, and roll everything up for group management. Which provider model fits depends on how many independent scopes you run.

Which information security management system (ISMS) and data protection management system (DPMS) tool fits a corporate group depends less on features than on structure: do you run one ISMS with a shared scope across several companies, or several independent management systems? With one shared scope and a handful of entities, a platform that assigns risks, documents, systems, and processing activities to each entity and filters by them is usually enough. If many subsidiaries hold their own certificates, have their own administrators, and need separate data, you need a tool with true tenant separation, inheritance of group requirements, and consolidated reporting; that usually means an enterprise GRC suite run by an in-house GRC team. On the privacy side, the obligations sit with each company either way, even when one tool holds them centrally.

Does the parent company's certificate cover its subsidiaries?

Only if they are in the scope. ISO 27001 requires the company to determine and document the scope of its ISMS in clause 4.3. The certification body audits exactly that scope. Under ISO/IEC 17021-1, clause 8.2.2, the certificate names each certified client and its location, plus the scope of certification; for multi-site certification, the headquarters and the sites within the scope. Anything not listed there is not certified, however the group markets its certificate.

For procurement and supplier reviews, that means reading the scope, not just checking that a certificate exists. The scope should name the company, the site, and the service you buy. For your own group, it means deciding before the audit whether a subsidiary joins the shared scope or gets its own certificate.

Does every subsidiary need its own ISMS?

No. One ISMS can cover several companies if they sit within its scope and the management system is run centrally. Separate ISMS make sense when subsidiaries have their own IT, their own customers with their own certificate requirements, or management with its own accountability. Legal obligations, however, do not follow the structure of your ISMS. Each follows its own rule:

A shared ISMS therefore saves work on policies, risk methodology, and controls, but not on the obligations tied to each company. How to serve several frameworks from one evidence base is covered on the page compliance platform for multiple frameworks.

Does a subsidiary fall under NIS2 because of its group's figures?

It can, if the subsidiary operates in a sector covered by the directive. The NIS2 Directive uses the size categories of Recommendation 2003/361/EC. Under Article 6 of its Annex, the data of an enterprise with partner or linked enterprises is established from the consolidated accounts; linked enterprises count in full, partner enterprises proportionally. A subsidiary with 30 employees in an in-scope sector can therefore cross the 50-employee threshold even though it sits below it on its own.

Each member state's transposing law sets the final scope, so check the law of the country where each subsidiary is established. Germany is an example of how much this changes the result. Section 28(4) of the German BSI Act leaves out partner and linked enterprise figures where a company is legally, economically, and actually independent of them in how it builds and runs its IT systems, components, and processes; a subsidiary on the group's IT can hardly rely on that. The same provision also disapplies Article 3(4) of the Recommendation's Annex, the rule that a 25 percent or larger public shareholding rules out SME status, so in Germany such a shareholding alone does not bring a company into scope.

What NIS2 means for mid-sized entities, and which provider model fits them, is covered on the page NIS2 software for mid-sized companies.

Is there a group privilege under the GDPR?

No. The GDPR defines a group of undertakings (Article 4(19)) but treats every company in it as a controller in its own right. Each company needs a legal basis for its processing, including for transfers to the parent or to sister companies, and as a rule keeps its own record of processing activities under Article 30. Recital 48 only recognizes that companies in a group may have a legitimate interest in transmitting personal data within the group for internal administrative purposes. That helps in the balancing test; it is not an exemption. Where one company processes data on behalf of another, such as a central IT or HR company, a contract under Article 28 is required; where both decide jointly on purposes and means, an arrangement under Article 26.

National law can attach further duties to each company. In Germany, Section 38(1) of the Federal Data Protection Act (BDSG) requires a data protection officer where a controller usually has at least 20 persons constantly engaged in automated processing of personal data. The threshold applies to each controller, not to the group. The German federal government has announced that it intends to introduce a repeal of Section 38(1) BDSG by the end of 2026; on October 23, 2026, the 20-person threshold was still the law.

Which providers support multiple entities?

Providers differ less in whether they can represent several companies than in how far the separation goes and who does the expert work. Four provider models cover the market. They are categories, not ratings of individual vendors; check how far a specific product goes in a demo.

If you have an experienced ISMS team in-house, the ISMS software comparison lists origin, standards, and G2 ratings of individual tools.

What does an ISMS and DPMS tool for multiple entities need to do?

Four capabilities separate providers in practice. Ask concrete questions in the demo instead of relying on the word "multi-tenant," which is used for very different implementations.

Not every group needs all four. If three companies share one scope and one IT, assignment and filtering per entity are enough. If ten companies hold their own certificates, inheritance and consolidated reporting become prerequisites.

How much does a group-wide ISMS cost?

Audit costs depend mainly on the number of persons in scope and the number of scopes, not on the number of companies. The audit time table of ISO/IEC 27006 sets the following audit days for initial certification. The certification body may deviate, in practice by up to 30 percent.

That creates a structural advantage. Under this table, two separate scopes of 60 persons each add up to 20 audit days, while one shared scope of 120 persons needs 12. Every audit day is billed at the certification body's day rate, and the gap recurs in every surveillance audit, for which certification bodies typically allow about a third of the initial audit time. With several sites, the certification body can set a sampling program under ISO/IEC 17021-1, clause 9.1.5, instead of auditing every site in full, provided the sites carry out similar activities. The table continues for larger scopes; the certification body states the exact audit days in its quote.

Preparation, implementation, and tooling come on top of audit fees. Kertos reference figures for the traditional consulting route up to 200 employees are on the page ISO 27001 certification cost.

When is Kertos the right choice for a corporate group?

Kertos fits groups with a few companies that run one shared ISMS with one scope and do not want to build a compliance department for it. With multi-entity management, you steer compliance for several legal entities, subsidiaries, or business units from one account. Each entity has its own master data and its own role holders, such as the information security officer or the data protection officer. Risks, documents, systems, vendors, assets, and processing activities can be assigned to one entity or to the whole group and filtered accordingly. Multi-entity management is included in the Pro and Premium plans and available as an add-on in Essential.

Kertos combines the platform with in-house certified experts. The platform and the AI agent KAIA are developed and hosted in Europe. ISO 27001, NIS2, and GDPR run from one shared evidence base, as do ISO 27701, ISO 42001, TISAX, SOC 2, C5, and the EU AI Act. Customers achieve a 100 percent audit pass rate and cut manual compliance effort by around 80 percent. On G2, Kertos is rated 4.8 out of 5 (as of October 2026). A demo shows what your group structure looks like in the platform.

When is Kertos not the right choice?

Kertos is not the right choice if your group needs separate tenants with data isolation per company or separate administrators per company. The same applies if many companies run independent certificates and group controls should be passed down with separate evidence per company, or if group management expects a consolidated dashboard across all companies. An enterprise GRC suite with an in-house GRC team is the better route for that. An external data protection officer or external CISO mandate from Kertos initially covers one company; whether it extends to further companies is agreed with the experts up front.

Frequently asked questions about ISMS and DPMS in corporate groups

Can a corporate group appoint one shared data protection officer?

Yes. Under Article 37(2) GDPR, a group of undertakings may appoint a single data protection officer, provided that the officer is easily accessible from each establishment. Each obligated company appoints them and publishes their contact details and communicates them to its supervisory authority (Article 37(7)). A shared data protection officer pools the task, not the accountability, which stays with each company. How the models for external data protection officers differ is covered in the external DPO provider comparison.

Is a group ISO 27001 certificate proof of NIS2 compliance?

No, but it is a strong foundation. An ISO 27001 certificate proves a certified ISMS for its scope. No certificate proves NIS2 compliance, and NIS2 obligations apply to each in-scope entity itself. Because the requirements overlap heavily, many groups still use one shared ISMS as the basis for both. What that looks like for mid-sized entities is covered on the page ISO 27001 software for mid-sized companies.