ISMS.online vs verinice

ISMS.online

A "Dynamic Risk Register & Treatment" and "automated risk assessments" clear the flat-list bar, but the evidence evidences no asset inventory, no risk methodology, no protection-needs inheritance and no incident workflows with statutory clocks — the only 24h figure is the vendor's own breach promise about itself. That is a register with treatment tracking and nothing behind it a certifier can trace.

verinice

The Grundschutz backbone is real: structure analysis with automatic inheritance of protection needs, object types for target objects, requirements, measures, threats and risks, and NIS2 incident deadlines of 24 hours, 72 hours and one month with the German implementation law's deviations incorporated. I found no public information on risk acceptance with named ownership or an export to the reporting authority, which keeps it out of the top band.

ISMS.online

Pre-configured control templates with owner assignment, review reminders and version history lift this above a consultant spreadsheet, but the evidence is silent on SoA generation from live status, measure delegation, internal audit workflows and findings management. "Automatic mapping to standards" appears as a policy feature, not evidence of a control fabric answering for itself.

verinice

Requirements, measures, threats and risks live as linked object types with building-block implementation, and the vendor states a BSI Testat under Basis-Absicherung and an ISO 27001 certification are achievable with the tool. I found no public information on generating a statement of applicability from live control status, measure ownership with delegation and escalation, or internal audit findings workflows.

ISMS.online

Over 100 frameworks with NIS2, GDPR, SOC 2, ISO 27701 and ISO 42001 named is broad by any measure, and the unified-platform claim suggests one data basis. But TISAX, DORA and BSI IT-Grundschutz never appear, and no documented update cadence exists in the evidence — I cannot credit maintenance I cannot see.

verinice

Six regimes live in one product — Grundschutz with licensed BSI content and BSI Standards 200-1 through 200-4, the ISO 27000 family through 27005 plus ISO 22301, TISAX, NIS2, GDPR and BCM — and NIS2 risk management is stated as integrated into the Grundschutz and ISO domains rather than answered as a separate checklist. I found no public information on DORA or a documented catalog update cadence beyond the NIS2 example, so this is not the living multi-compliance fabric of the top band.

ISMS.online

Audit readiness appears as an adjective; the only defensible history in the evidence is policy-level version history and approval workflow. No evidence packs, auditor access roles, management-report generators or state-on-date-X capability are evidenced, so the audit file is assembled by hand the week before — exactly what I reject.

verinice

The captured pages evidence audit-facing output of the Grundschutz kind — a realization and audit plan, stated certification paths to a BSI Testat and ISO 27001, and a partner network that accompanies certifications and audits. I found no public information on revision-safe change history, evidence attachments per control, audit-scoped report packs or auditor access roles, and I do not credit a change trail no page documents.

ISMS.online

Native connectors (ServiceNow, Teams, SharePoint), a public API and policy import are real plumbing, but the Google Drive integration is explicitly a file-picker only, and no directory import, CMDB, scanner, SSO/SCIM or automated evidence test appears anywhere. "Automates compliance tasks" is a claim, not a connector.

verinice

I found no public information on directory import, CMDB or ticketing connections, a documented API, single sign-on, or automated evidence collection — nothing on the captured pages describes the platform feeding from the live IT estate. The fully open-source codebase is the only mitigant: it is inspectable rather than a black box, but publication of source is not evidence of integrations existing.

ISMS.online

Alliantist Ltd, England and Wales, with selectable UK/EU/US/APAC data centres and a published subprocessor list — but that list includes Google, Microsoft, AWS, Anthropic and OpenAI, EU-default hosting is not stated, and no public DPA/TOMs boundary on content-touching processors is evidenced. A UK entity holding your risk register with US processor exposure does not read as clean jurisdictionally.

verinice

A German GmbH in Göttingen under the Lower Saxony supervisory authority, GDPR and BDSG as the stated benchmark, and — the decisive lever — a purchasable on-premises subscription plus open source, so the risk register can live entirely in the operator's own infrastructure. For the cloud offer, however, I found no public information on hosting locations, a subprocessor list or a data processing agreement, and the vendor itself lists a San Francisco office.

ISMS.online

The vendor's own page: "IO's pricing is bespoke to you, this means you're not paying for things you don't need" — a tailored quote via sales, no published seat, tier or module numbers. No real invoice is computable from public pages; this is the textbook 0.

verinice

The three bundles carry public annual from-prices — quoted as "from 5.750 € / year", "from 8.530 € / year" and "from 5.750 € / year" — with a free evaluation and self-service purchase portals for cloud and on-prem. The scale basis behind "from" is not stated, the captured pages show no price for the standalone NIS2 subscription or the additional modules, and they give different figures for the free NIS2 evaluation length, so the real invoice is not yet computable.