ISMS.online vs verinice

ISMS.online

There is a 'Dynamic Risk Register & Treatment' and a claim of automated risk assessments, so treatment tracking exists — above the flat-list floor. But the evidence shows no asset inventory, no risk methodology, no protection-needs inheritance, and no incident workflows with statutory clocks; NIS2 appears only as a domain label, and the quoted 24-hour breach target is ISMS.online's own privacy-policy promise about their handling, not a product feature.

verinice

A genuine risk backbone: BSI IT-Grundschutz methodology end to end with structure analysis, protection-needs definition, automatic protection-need inheritance across asset relations, threats and risks as first-class objects, and NIS2 incident workflows carrying the statutory 24-hour and 72-hour clocks. I found no public information on risk acceptance with named ownership or executive-level risk reporting, so I stop short of the top bench.

ISMS.online

Pre-configured control templates with owner assignment, review reminders, version history and approval workflow, plus the claim that updating a risk, policy or evidence ripples across the platform, gives me measures with owners and a live linkage story. Missing for a five or an eight: no SoA generation anywhere in the evidence, no internal audit or findings workflows, and no evidence that controls carry their own evidence.

verinice

The control side is properly modeled — requirements, measures and module implementation with an implementation and audit plan, TOMs captured per business process, and the Basis-/Standard-/Kernabsicherung choice as a structured applicability decision — but I found no public information on SoA generation from live control status, measure ownership with delegation and escalation, or internal-audit findings management.

ISMS.online

100+ frameworks including ISO 27001, ISO 27701, ISO 42001, SOC 2, GDPR, NIS2 and the EU AI Act is real breadth, and ISO 27001:2022 is the current version on their framework page. But 'automatic mapping to standards' attaches to policies, not to a one-control-many-frameworks answer, and TISAX, DORA and BSI IT-Grundschutz are absent — I can't credit the cross-compliance mapping that makes client twelve cheaper than client one.

verinice

Six regimes operationalized for its market — IT-Grundschutz with BSI Standards 200-1 to 200-4, ISO 27001 through 27005 and 22301, TISAX, NIS2, BCM and GDPR — with licensed BSI and ISO content, and visible maintenance as the German NIS2 implementation act's deviations are already integrated. NIS2 risk requirements are woven into the Grundschutz and ISO domains rather than shipped as a separate island, but explicit one-control-many-frameworks mapping is only implied, and I found no public information on DORA or SOC 2.

ISMS.online

Version history with approval workflow and evidence as first-class objects that ripple on change are a start, and the 'audit readiness' and 100% first-time-pass claims are marketing, not proof. No report generators, no audit-scoped evidence packs, no auditor access roles, no 'state on date X' — assembling the audit file still looks like days of manual work.

verinice

Certification targets are explicitly supported — ISO 27001 on a Grundschutz basis and a BSI Testat in Basis-Absicherung, backed by a partner network for audits — and the implementation and audit plan gives the auditor something to walk. I found no public information on revision-safe change history, audit-scoped evidence packs, auditor access roles, or a defensible state-on-date-X answer, which is what this criterion pays for.

ISMS.online

ServiceNow plus SharePoint, Teams and Google Drive with a Public API and custom integrations clears the connector floor — except the Google Drive connector is explicitly a file picker and link, never touching the file, which tells me these are link-level, not data-sync. No directory import, no SSO/SCIM, no CMDB, no automated evidence collection; 'automates compliance tasks' reads as workflow reminders dressed up.

verinice

I found no public information on a REST API, directory or CMDB import, ticketing connectors, SSO/SCIM, webhooks or automated evidence collection anywhere in the captured pages. The fully open-source release since 2006 is real, but open source is not evidence of an integration surface.

ISMS.online

UK entity (Alliantist Ltd, England & Wales) with an EU data-centre option of Germany plus Sweden backup and a published subprocessor list keeps this off the floor. But that list is heavy with US-reach processors (OpenAI, Anthropic, Google, Microsoft, AWS), there are no named data centres beyond country level, no DPA or TOMs in evidence, and the jurisdiction is post-Brexit UK with US transfer mechanisms — not the European-clean chain I want under a risk register.

verinice

The sovereign deployment path is genuine — German entity under German law since 1997, a self-operated on-premises subscription, fully open GPLv3 source, and a named German supervisory authority — and payment processors stay outside the product. But the captured pages do not confirm where verinice.cloud data is hosted, I found no public DPA or product subprocessor list for the cloud service, ownership is undocumented, and the company lists a San Francisco office.

ISMS.online

Bespoke pricing with no published seat or tier prices, every quote tailored via sales contact, and the buying path is a 30-minute demo — the anchor's exact definition of zero. You cannot compute any part of the real invoice from public pages.

verinice

Three bundles carry real public annual figures — ISO 27001 from 5.750 € / year, IT-Grundschutz from 5.750 € / year, ISO + IT-Grundschutz from 8.530 € / year — with lengthy free evaluations in the cloud. These are "from" prices with no user or entity scale steps, no module add-on prices and no price on the standalone NIS2 subscription, so the real invoice for a given organization is not computable from the public pages alone.