preeco | informationssicherheit

The Drafted IT Officer

This is a real risk backbone, not a spreadsheet: protection needs come from a damage-scenario matrix using the maximum principle with accumulation across linked systems, risks link directly to the measures that reduce them, and incident handling ships with nine ready-made report templates for BSI, KRITIS and GDPR whose reporting deadlines are monitored automatically. The guided step-by-step implementation is exactly what someone doing this alongside the day job needs. We found no public information on business continuity planning, which keeps it off the top mark. 8 2 12 2 13 14 17

Report an error

The Drafted IT Officer

The statement of applicability is genuinely automatic: setting a requirement to not applicable forces a justification that flows into the SoA, filed as an immutable dated version per catalog, while measures carry owners, status and versioning and link to risks and protection needs. Audits recur on schedule with central evidence and controls answer with their own evidence. We found no public information on delegating measures with escalation or on tracking audit findings to closure, so it sits just under the next mark. 7 7 15 16 17

Report an error

The Drafted IT Officer

The German-market regimes are there as ready catalogs — ISO 27001, NIS2 and BSI C5 plus optional paid BSI IT-Grundschutz, CISIS12 and VdA ISA and a municipal SiKoSH catalog — though the captured pages give different figures for which catalogs are included where. Only one catalog is active per organization and we found no public information on one control answering several frameworks, so regimes read as separate islands rather than shared compliance data; DORA appears only as a statement that new requirements will be implemented promptly. 2 12 2 7 17 18

Report an error

The Drafted IT Officer

Evidence sits directly on each requirement with a validity date, cockpit expiry warnings and a request link for people without an account, and every approval creates an immutable revision with SHA-256 integrity checks plus complete activity logs filterable by time and user. Management and audit reports recur automatically. We found no public information on external auditor access roles or audit-scoped evidence packs, and revisions older than the feature cannot be verified retroactively, so this stays just below the next mark. 2 2 19 20

Report an error

The Drafted IT Officer

The vendor states plainly that the application is designed as a closed system with no public REST API; custom endpoints exist only as bespoke development on private cloud or on-premises hosting. Feeds are XLSX import and exports in PDF, DOCX and XLSX, and automation means reminders, recurring reports and deadline monitoring. That works for a first ISMS but means re-typing what my directory and ticket system already know. 2 12 2 19

Report an error

The Drafted IT Officer

My risk register would live with a German vendor in named ISO 27001 data centers at Hetzner in Nürnberg and Falkenstein, no third-country transfer, a published DPA with GDPR standard clauses and downloadable TOMs, and an on-premises option where data never leaves my datacenter. Named sub-processors are Hetzner in Germany and UpCloud in Finland, both EU. The full sub-processor list sits in a DPA appendix the captured pages do not show, ownership is not publicly documented, and optional DeepL or OpenAI-compatible integrations would add further processors, so the chain is not verifiably clean end to end. 9 10 11 12 2

Report an error

The Drafted IT Officer

There are no public prices: the license and pricing model is prepared as a separate individual offer depending on employee count, chosen modules and hosting variant. Public statements about the model are helpful — annual subscription, monthly or yearly billing, updates and support included, no setup fees, no notice periods — but add-ons like the audit catalogs, DeepL and premium support carry no figures, so the real total cannot be computed from public pages. 2 12

Report an error