ISMS.online vs verinice

ISMS.online

A "Dynamic Risk Register & Treatment" clears the flat-list bar, but nothing in the evidence evidences an asset inventory, a documented risk methodology, inherited protection needs, or incident workflows with statutory clocks — the only 24-hour figure on record is the vendor's own privacy-policy promise, not a product feature. The supply-chain module gestures at third-party risk; the ISMS core stops at register-plus-treatment.

verinice

The BSI methodology is implemented as real objects — targets, requirements, measures, threats, risks — with automatic protection-needs inheritance and supporting structural analysis, and the NIS2 domain carries the statutory clocks (report after 24 hours, situation report after 72 hours, final report after one month). Risk management per NIS2 Article 21 is documented as integrated into both the Grundschutz and ISO 27001 domains. We found no public information on risk acceptance with named ownership or executive-level risk reporting.

ISMS.online

Policy versioning, approval workflows, owner assignment and review reminders are genuine document management, and controls ship as pre-configured templates with claimed automatic mapping to standards. But the SoA — in the criterion's own name — appears nowhere: no SoA generation, no measure delegation or escalation, no internal audit workflow or findings management anywhere in the evidence.

verinice

Requirements and measures are first-class objects with module-implementation tracking, basic security checks, an implementation-and-review plan, and per-process TOM capture in the NIS2 domain. We found no public information on statement-of-applicability generation, measure ownership and delegation, or internal audit workflows with findings management — for a tool positioned at ISO 27001 certification, that is the part of the fabric the pages never show.

ISMS.online

"100+ frameworks" is asserted identically on three pages with no framework list behind it — and GDPR is being counted as a framework — while what is actually named is ISO 27001/27701/42001, SOC 2, NIS2, EU AI Act and NIST. That's the major regimes as content packs of unverified depth; TISAX, DORA and BSI IT-Grundschutz are absent, and one-control-many-frameworks mapping is implied ("manage everything in one place") but never demonstrated as a mechanism.

verinice

The German stack is deep and current: IT-Grundschutz with BSI Standards 200-1 through 200-4, the ISO 27000 series including 27005, TISAX, NIS2 with the German NIS2UmsuCG deviations marked, GDPR and BCM. Cross-framework work is evidenced rather than just logo-claimed — ISO 27001 certification on the basis of IT-Grundschutz, NIS2 risk requirements folded into both domains — and the German-law integration is visible maintenance as a regime moved. We found no public information on DORA or SOC 2 coverage, per-industry profiles, or a documented update cadence.

ISMS.online

The headline claim is exactly the kind I exist to flag: "Every customer following our Assured Results Method has passed first-time" — a survivorship slogan with no denominator. Underneath it sit policy version history and approval workflow and a claimed instant propagation of evidence updates, but no revision-safe change history across objects, no auditor access roles, no report generators or evidence packs, and no answer to "show me the state on date X".

verinice

The captured pages position the tool inside real certifications — a BSI Testat under Basis-Absicherung and ISO 27001 based on IT-Grundschutz — with use since 2007 across critical infrastructure, plus contract and document management in the NIS2 domain. But the certification and audit support rides heavily on the partner network, which is services rather than proof the product generates, and we found no public information on revision-safe change history, audit-scoped evidence packs, management reports or auditor access roles.

ISMS.online

Four named connectors plus a Public API clear the CSV tier — until the fine print reveals the Google Drive "integration" is a file picker and link maker that "never accesses... the file itself". No directory import, SSO/SCIM, CMDB, webhooks or automated evidence tests appear anywhere, and "automates compliance tasks" is a slogan, not a mechanism.

verinice

The only automation the captured pages evidence is internal to the tool: automatic protection-needs inheritance and methodology checks. We found no public information on a REST API, directory or CMDB import, ticketing or scanner connectors, SSO/SCIM, or automated evidence collection — for a product sold both as SaaS and on-premises, that silence is conspicuous.

ISMS.online

The risk register would live with Alliantist Ltd, an England-and-Wales company under UK private equity majority (ECI Partners), with an EU region offered as one of four choices — UK, EU, US, APAC — and no stated default. The published subprocessor list is a who's-who of US CLOUD Act reach (OpenAI, Anthropic, Google, Microsoft, AWS, Stripe), and no public DPA or TOMs are evidenced: an EU region on request with broad US exposure.

verinice

The entity is German (SerNet Service Network GmbH, Göttingen, commercial register HR B 2816), the code is fully open source under a GPLv3 provenance since 2006, and a self-operated on-premises variant exists — genuine jurisdictional levers. But the "only sovereign ISMS tool" claim outruns the published record: we found no public information on where verinice.cloud is hosted, a published data processing agreement or TOMs for the product itself, or the cloud's subprocessors, and ownership is undocumented while the vendor lists an office in San Francisco.

ISMS.online

"IO's pricing is bespoke to you" — no number, tier, module price or billing period exists anywhere in the evidence, so every invoice is a sales conversation. Worse, the product is sold as platform+process+people with "ISO experts and lead auditors" as assigned CSMs from day one, making services structurally inseparable from the unpriced software.

verinice

Three bundles carry real annual figures quoted as from 5.750 € / year and from 8.530 € / year, evaluations are free, purchase runs through self-service portals, and consulting lives in a partner network rather than inside the software price. The real invoice stays incomputable: these are "from" figures with no user or entity boundaries stated, the standalone NIS2 subscription carries no public price, and the captured pages give different figures for the NIS2 evaluation period — 30 days on one page, 60 days on another.