What is the best ISO 27001 software for mid-sized companies?

Last updated: October 12, 2026. Vendor details verified on the vendors' own public pages on October 12, 2026; details on VdS 10000, CISIS12, and IT-Grundschutz verified on the publishers' own pages.

Key Takeaways

• No ISO 27001 software is the best choice for every mid-sized company. The deciding question is who will run the information security management system (ISMS) after certification.
• If an information security officer with ISMS experience is in-house, an ISMS tool such as GRASP, HiScout, otris isms, or verinice can be enough. If that role is missing, a platform with experts is usually the realistic route, as offered by DataGuard, heyData, Kertos, and Secfix.
• That role is often missing: in the Kertos NIS2 Readiness Study 2026, 84% of 51 German companies with 50 to 1,000 employees had neither an in-house nor an external CISO.
• ISO 27001 is voluntary. Mid-sized companies usually get it because customers ask for it, through supplier requirements, tenders, or the NIS2 supply chain duties of regulated customers.

Which ISO 27001 software fits a mid-sized company depends less on features than on who does the expert work on the ISMS. If an information security officer with ISMS experience is in-house and has time for ongoing operation, an ISMS or GRC tool can be enough; typical vendors of this model are GRASP, HiScout, otris isms, and verinice. If nobody fills that role, a tool on its own stays largely empty. A platform with included experts is then usually the realistic route, as offered by DataGuard, heyData, Kertos, and Secfix. In between sit ISMS.online, secjur, and Vanta, where experts are optional or come through partners. For a mid-sized company, the years after the first audit matter most: two surveillance audits and a recertification follow, and the ISMS has to keep running the whole time.

Why do mid-sized companies need ISO 27001?

No law requires a typical mid-sized company to hold ISO 27001. According to ISO, the standard is meant for companies of any size and sector, and each company decides for itself whether to go through certification. In practice, the push usually comes from outside:

• Customers and large enterprises: Large buyers and OEMs often ask suppliers and service providers for an ISO 27001 certificate or comparable evidence, frequently as part of supplier onboarding.
• Tenders: Public and private tenders often list a certificate as a qualification criterion.
• NIS2 in the supply chain: Article 21(2)(d) of the NIS2 Directive requires in-scope entities to secure their supply chain, including the relationships with their direct suppliers and service providers. Regulated customers therefore pass requirements on to their suppliers by contract, including suppliers that are not in scope themselves. Whether your own company is in scope is covered on the page NIS2 software for mid-sized companies.

An ISO 27001 certificate shows a certified ISMS. No certificate proves NIS2 compliance. Because the requirements overlap heavily, many companies still use one ISMS as the shared foundation for both.

Is there a lighter alternative to ISO 27001?

Germany has two leaner ISMS standards built with smaller companies in mind. VdS 10000 comes from VdS Schadenverhütung GmbH, targets small and medium-sized companies, and is certified by the VdS certification body; VdS describes it as upward-compatible and an entry point to the ISO 27000 series. CISIS12, owned by the IT-Sicherheitscluster e.V. and the successor of ISIS12, is certified by approved certification companies with an annual surveillance audit; its publisher says it does not replace ISO 27001. A customer who asks for an ISO 27001 certificate does not get the evidence it asked for from either of them.

Which type of ISO 27001 software fits which mid-sized company?

The three provider models differ in who does the expert work: your team, the vendor, or both. The vendors named are examples of each model, not a recommendation for your specific case.

The officer question decides because a tool manages risks and evidence but does not assess them. Clause 5.3 of ISO 27001 requires top management to assign responsibilities and authorities for the roles relevant to information security. The standard does not prescribe a job title. Someone still has to do the work: lead the risk assessment, prioritize controls, and represent the ISMS in front of management and the auditor. In mid-sized companies that person is often missing. The Kertos NIS2 Readiness Study 2026 surveyed 51 companies based in Germany with 50 to 1,000 employees between August 3 and September 4, 2026: 84% had neither an in-house nor an external CISO, and in 41% the head of IT was the only responsible role named. The study asked about NIS2, not ISO 27001; it still shows who carries information security in these companies.

The tools in the first model often cover BSI IT-Grundschutz alongside ISO 27001, for example otris isms and verinice. Origin, standards, and G2 ratings of further vendors are set out in the full ISMS software comparison.

What does ISO 27001 software need to do for a mid-sized company?

• Risk assessment and Annex A controls with owner and evidence: ISO 27001 requires a risk assessment, a risk treatment, and a Statement of Applicability for the Annex A controls. The software should assign every risk and control to an owner, show its implementation status, and store the evidence where the auditor can find it.
• Customer requests answered from the same evidence base: A company that adopts ISO 27001 because of its customers keeps receiving their security questionnaires and supplier assessments. Software that answers them from existing evidence, instead of starting each questionnaire from scratch, helps here. If an automotive customer also asks for a TISAX assessment, the same base should carry that too.
• Years 2 and 3 without a project team: The certificate is valid for three years. In each of the two following years the certification body checks the ISMS in a surveillance audit, and recertification follows in year three. The software should schedule internal audits, management reviews, risk reviews, and due evidence so that operation continues without a dedicated project team.

How much audit time you face depends on the number of persons in the ISMS scope. The audit time table of ISO/IEC 27006 sets the following audit days for initial certification at mid-sized scopes. The certification body can adjust them, in practice by up to 30 percent.

For a surveillance audit, certification bodies customarily plan about one third of the initial audit time; this is common practice, not a value from the standard's table. For scopes above 175 persons, the certification body states the audit days in its quote.

When is Kertos the right choice for mid-sized companies, and when is it not?

Kertos fits mid-sized companies without an internal security role that want to run ISO 27001 continuously without tying up internal staff. Kertos combines a platform with certified experts who are in-house at Kertos. They can take on the external CISO mandate and support internal audits, management reviews, and the certification body's audits. The platform and the AI agent KAIA are developed and hosted in Europe. ISO 27001, NIS2, and TISAX run from a shared evidence base, as do ISO 27701, ISO 42001, GDPR, SOC 2, C5, and the EU AI Act.

Customers achieve a 100 percent audit pass rate and around 80 percent less manual compliance effort. AskUI achieved ISO 27001 certification with Kertos in 8 to 10 weeks without external consultants. Kertos is rated 4.8 out of 5 on G2 (as of October 2026). A demo shows what implementation looks like for your scope.

Kertos is not the right choice if an experienced information security officer is already in place and only wants a documentation tool; an ISMS tool from the first model is enough then. The same applies if you must run the software on-premises or use BSI IT-Grundschutz as your leading standard.

Frequently asked questions about ISO 27001 software for mid-sized companies

Is ISO 27001 mandatory for mid-sized companies?

No. ISO 27001 is a voluntary standard, and no law requires a typical mid-sized company to be certified. NIS2 does not require an ISO 27001 certificate either. In practice, though, customers, large enterprises, and tenders often ask for one, and regulated customers pass their NIS2 supply chain duties under Article 21(2)(d) of the directive on to their suppliers.

How long does ISO 27001 certification take for a mid-sized company?

Realistically 3 to 12 months from project start to certificate; larger or more complex companies tend to need 9 to 12 months. Scope, the maturity of existing security, and available resources decide where you land. Before the stage 2 audit, an internal audit and a management review must have taken place and be documented. The phases are set out on the page How long does ISO 27001 certification take?

What does ISO 27001 cost for a mid-sized company?

The cost is made up of preparation, implementation, the certification body's fees, and the annual surveillance audits. Audit fees rise with audit days and therefore with the number of persons in scope; each certification body sets its own day rates. Kertos reference figures for the traditional consulting route by company size are on the page What does ISO 27001 certification cost?