ISMS soft­ware
from otris

Whether you are an ex­tern­al se­cur­ity con­sult­ant serving mul­tiple clients, working in a company or public au­thor­ity, or man­aging the in­form­a­tion se­cur­ity of a cor­por­a­tion as part of a team, otris isms adapts to your re­quire­ments. The soft­ware is multi-client capable and suit­able for mapping mul­tiple or­gan­isa­tion­al units and in­form­a­tion net­works. This means that your ISMS remains con­sist­ently con­trol­lable even as your struc­tures grow.

A dif­fer­en­ti­ated access concept allows you to define roles and rights – de­pend­ing on re­quire­ments for groups or in­di­vidu­al ISMS data con­trol­lers. Browser-based access to the central system pro­motes col­lab­or­a­tion and ensures a uniform level of in­form­a­tion. You can direct in­form­a­tion pro­cesses – such as the editing or pub­lic­a­tion of guidelines – to spe­cif­ic user groups. Check­lists can be edited ex­tern­ally: as an en­cryp­ted HTML ques­tion­naire that is auto­mat­ic­ally pro­cessed in the system after it has been answered.

There are three soft­ware edi­tions to choose from, al­low­ing you to tailor the range of func­tions to your needs. Stand­ard­ised ex­ten­sions and sup­ple­ment­ary modules enable you to expand the system flex­ibly. If you have ad­di­tion­al re­quire­ments, otris can im­ple­ment a cus­tom­ised solu­tion tailored to your needs. Ex­ist­ing systems can be con­nec­ted via bi­d­irec­tion­al REST in­ter­faces, for example.

All logged pro­cesses and doc­u­mented in­form­a­tion can be eval­u­ated flex­ibly. The in­de­pend­ently con­fig­ur­able dash­boards provide a quick over­view of all es­sen­tial ISMS pro­cesses and lead dir­ectly to clearly presen­ted de­tailed in­form­a­tion. Sup­ple­ment­ary report queries are avail­able for both the entire ISMS (e.g. SoA) and at object level and can be gen­er­ated as reports (e.g. Excel, PDF).

You are free to choose whether you want to use the ISMS soft­ware in the cloud or on-premises. On-premises means that the system is op­er­ated on your company’s own IT in­fra­struc­ture. With the cloud version, you access the servers of a secure, cer­ti­fied data centre (loc­a­tion: Germany). In both cases, you use a web browser to work with the soft­ware.

With otris isms, you can define the scope of your ISMS as an in­form­a­tion network, analyse and doc­u­ment the or­gan­isa­tion­al and reg­u­lat­ory context, and the res­ult­ing in­form­a­tion se­cur­ity ob­ject­ives, guidelines and roles in con­trolled doc­u­ments. This creates a robust found­a­tion for an ef­fect­ive ISMS – tailored to busi­ness ob­ject­ives and risks.

otris isms cent­rally provides rel­ev­ant stand­ards and spe­cific­a­tions cata­logues (e.g. ISO/IEC 27001, BSI IT-Grunds­chutz) as well as threat and doc­u­ment tem­plates based on them. For the defined in­form­a­tion network, the as­signed spe­cific­a­tions can be rated in terms of ap­plic­ab­il­ity and ef­fect­ive­ness and doc­u­mented in a trace­able manner.

Assets can be re­cor­ded both within otris ISMS and via import tem­plates – in­clud­ing net­work­ing in pre­par­a­tion for the pro­tec­tion needs ana­lys­is. Assets can also be en­riched with cus­tom­er-spe­cif­ic in­form­a­tion.

otris isms sup­ports various con­fig­ur­able process models for as­sess­ing and in­her­it­ing pro­tec­tion re­quire­ments. Pro­tec­tion ob­ject­ives such as con­fid­en­ti­al­ity, in­teg­rity and avail­ab­il­ity are re­cor­ded and rated in a struc­tured manner. The pro­tec­tion re­quire­ments ana­lys­is results in a list of crit­ic­al assets for further ana­lys­is.

Risks can be sys­tem­at­ic­ally iden­ti­fied, rated and ad­dressed both across the entire network – based on the threat cata­logue – and at asset level. Risk man­age­ment meas­ures are derived in line with spe­cific­a­tions, re­spons­ib­il­it­ies are clearly as­signed and the im­ple­ment­a­tion status is tracked trans­par­ently. In this way, otris ISMS sup­ports in­formed de­cisions and risk-ori­ented man­age­ment of in­form­a­tion se­cur­ity.

As part of asset mod­el­ling, the re­quire­ments to be met are as­signed to the cor­res­pond­ing assets. Com­pli­ance with re­quire­ments is de­term­ined auto­mat­ic­ally, for example, on the basis of binding doc­u­ments as­signed to the asset.

Unmet re­quire­ments auto­mat­ic­ally lead to the as­sign­ment of cor­res­pond­ing risks, which are iden­ti­fied and further con­sidered as part of the risk ana­lys­is.

Doc­u­mented rules linked to spe­cific­a­tions, as well as their veri­fi­able pub­lic­a­tion and dis­tri­bu­tion, are es­sen­tial com­pon­ents of an ISMS. otris isms in­cludes com­pre­hens­ive doc­u­ment control – from ed­it­or­i­al cre­ation and ap­prov­al routines to func­tions for pub­lic­a­tion, tar­geted de­liv­ery and ac­know­ledge­ment mon­it­or­ing.

Ex­tern­al and in­tern­al audits as well as in­cid­ents are con­sol­id­ated in otris ISMS. The solu­tion sup­ports ques­tion-based audits both in­tern­ally and at sup­pli­ers and service pro­viders. Audit find­ings are sys­tem­at­ic­ally doc­u­mented, meas­ures are derived and tracked until their im­ple­ment­a­tion has been veri­fied.

Central eval­u­ations such as SoA, IT baseline pro­tec­tion check, guideline cur­rency, guideline con­firm­a­tion level and task man­age­ment per­form­ance in­dic­at­ors are avail­able to provide veri­fi­able doc­u­ment­a­tion of the es­tab­lished in­form­a­tion se­cur­ity man­age­ment system. This means you can provide in­form­a­tion at any time – to man­age­ment, aud­it­ors and su­per­vis­ory bodies.