Which frameworks are included in Docusnap?

ISO 27001, NIS 2 and DORA come as complete, pre-loaded frameworks. The included objectives and controls can be assessed and interlinked directly, without having to build a catalogue first.

Platform

Always audit-ready instead of last-minute sprints

ISO/IEC 27001 is preloaded. For NIS2 in Germany and Austria and for GDPR, Docusnap comes with its own frameworks. You always see where you stand and what evidence is still missing.

Try now Request a demo

Ready to use with pre-loaded frameworks

ISMSFramework overview

Compliance foundation

Frameworks, controls and completeness in one place

Docusnap starts with the ISO 27001 standard and the BSI Cloud Computing Compliance Criteria Catalogue (C5). We built the compliance frameworks for NIS2 and GDPR ourselves, so you don’t start from scratch. For NIS2, you get one framework for Germany (BSI Act, BSIG) and one for Austria (NISG). You assess each control individually, link controls to one another and connect them to measures, documents and assets, so it stays visible how a measure contributes to a control and which systems it affects. The completeness overview shows where evidence exists and where gaps remain.

ISMSControl overview

Pre-loaded frameworks

ISO 27001, the BSI cloud catalog (C5) and our own frameworks for NIS2 (DE, AT) and GDPR are included. You start with the assessment right away.

Assess and link controls

Each control is assessed individually. Links between controls make visible which measure contributes to ISO 27001 and NIS2 at the same time.

Completeness at a glance

The completeness overview continuously shows where evidence exists and where gaps remain. No scrambling before the audit date.

Frameworks are in place, controls are ready for your assessment.

Try now

AI support

Ask instead of reading reports

AI-powered analysis supports you in assessing controls and analysing your ISMS status. Ask questions about your documented controls and evidence instead of working through reports.

Which servers are running at the Munich site?

42 servers at the Munich site, 31 of them virtual on four hosts.

Which Windows servers are out of support?

Seven servers run Windows Server 2012 R2, support ended in October 2023.

Who has access to the finance share?

18 accounts across three groups, four of them with full access.

Which systems have had no update for 30 days?

96 clients and five servers have had no update for more than 30 days.

Where is SQL Server 2016 still running?

Four instances on three servers, two of them holding ERP databases.

Suggestions

Show me every device on my network.

Who has access to which shares?

How do I keep my IT documentation up to date?

Create an emergency handbook for me.

Try Docusnap365 →

Ask your IT documentation …

Learn more

Learn more about AI support in Docusnap

Daily operations

From setup to day-to-day

An ISMS does not run on the initial assessment alone. What matters in practice is whether reviews recur reliably, exceptions are properly documented and changes remain traceable.

Applicability and exceptions

Non-applicable controls are documented with a stated reason, not silently skipped. That is the first question in any audit.

Recurring measures

Annual reviews and periodic evidence requirements appear automatically as tasks. They do not need to be remembered.

Reviews with deadlines and owners

Every control has a review date and an assigned person. No shared responsibility, no forgotten deadlines.

Relationships and change history

Controls, measures, documents and assets are interlinked. Every change is recorded in the journal. In an audit, the path matters as much as the current state.

Platform

Compliance on real systems

The ISMS module runs on the same platform as the CMDB, permission analysis and controlled SmartDocs. Controls are attached to real assets, not to a separate description of the target state.

CMDB

Controls and measures are linked to real IT systems documented in the CMDB. Compliance evidence is based on the actual state of the infrastructure.

CMDB in detail

Controlled SmartDocs

Policies and procedures are maintained as controlled documents, versioned and approved. For every document, it is traceable who changed it and when.

SmartDocs in detail

Permission analysis

Permission analysis shows who can access which systems and data. For access management controls under ISO 27001, a reliable basis instead of manual surveys.

Permission analysis in detail

Frequently asked questions about the ISMS module in Docusnap

Which laws and standards are preloaded in Docusnap?

ISO 27001 and the BSI Cloud Computing Compliance Criteria Catalogue (C5) are preloaded. The C5 comes from the Federal Office for Information Security (BSI) and describes minimum requirements for the information security of cloud services. Docusnap adds three frameworks of its own: “BSIG – Requirements from the NIS2 implementation” for Germany, “NISG (Austria) – Requirements from the NIS2 implementation” and the “GDPR Compliance Framework.” You assess and link objectives and controls right away, without building your own catalog.

Does Docusnap support GDPR implementation?

Yes, with its own compliance framework. It derives specific, verifiable requirements from the obligations of the General Data Protection Regulation, for example on processing principles, data subject rights, security and incident management, and data protection impact assessments. You assess the implementation status of each requirement, document why items don’t apply, and see open gaps at a glance. There is no certification for the GDPR. The framework does help you demonstrate your accountability under Art. 5(2) in a traceable way.

How does Docusnap show where evidence is missing?

The completeness overview shows the status of all controls and evidence. You can see which controls have been assessed, where documents are missing and which reviews are due.

How does the link between controls and assets work?

Controls are linked to measures, documents and assets from the CMDB. This makes visible which IT systems are affected by a control and whether the associated evidence is in place.

What happens when a control is not applicable?

Non-applicable controls are documented as an exception with a stated reason. These exceptions are part of the ISMS evidence and appear in audits as a deliberate decision, not as a gap.

How does AI support ISMS work?

AI-powered analysis helps with assessing controls and analysing the ISMS status. You ask questions about your documented controls and evidence and receive answers based on your actual data.

How are recurring reviews managed?

Measures can be set up as recurring. Annual reviews or periodic evidence requirements appear automatically as tasks with a deadline and an assigned person.

Does Docusnap support NIS2 in Austria as well?

Yes. Alongside the framework for the German BSIG, there is a framework based on the Austrian Network and Information Systems Security Act (NISG). Both derive their requirements from the respective NIS2 implementation and can be assessed separately, so you track your implementation status per country.

Are these official standards?

Partly. ISO 27001 and the BSI C5 catalog are published standards and catalogs from their publishers. We developed the frameworks for NIS2 and GDPR ourselves, based on the current legal texts. The NIS2 frameworks draw on the German BSIG and the Austrian NISG. None of the three is an official version. In return, you don’t have to work through the legal texts yourself and can record status and evidence per requirement right away.

What effort does Docusnap take off my plate?

Turning legal texts into verifiable requirements is a project in its own right. We have done that. Your work starts where it concerns your company: assessing your implementation status.

Start ISMS

Start with the ISMS that already knows your IT landscape

Standards and frameworks are preloaded, controls are waiting for your assessment.