Standards & management systems
From ISO 27001 and BSI IT-Grundschutz++ to C5 and TISAX — the standards and frameworks that make security certifiable.
Governance, Risk & Compliance
ISO 27001, BSI IT-Grundschutz, NIS2, DORA, CRA and the EU AI Act: how to bring management systems, risk management and regulatory obligations into one audit-ready, integrated structure — without duplicating work.
Good governance is not paperwork — it is the operating system of your security: an integrated management system translates standards and regulation into clear responsibilities, measurable controls and evidence that holds up in an audit. These knowledge pages bundle our methodology on standards, EU regulation and day-to-day operations — from gap analysis and certification to vCISO and GRC as a Service.
Topics & knowledge pages
Each topic leads to a dedicated knowledge page with deep dives, practical guides and the matching services.
EU & national regulation
NIS2, DORA, CRA, EU AI Act, KRITIS and MDR — obligations, deadlines and the path to demonstrable compliance.
NIS2 DORA EBA Guidelines on Third-Party Risk (Non-ICT) BaFin Guidance on AI & ICT Risks Slopsquatting & Coding Agents EU Cyber Resilience Act ENISA Secure by Design Playbook EU AI Act KRITIS MDR — Medical Devices AI Risk Management in Clinical Settings Maintenance of Connected Medical Devices Data Act & connected medical devices AI Compliance
Operations, roles & evidence
Keeping compliance alive: external CISO and ISO roles, audits, training and automated evidence.
Supply Chain Security
Third-Party-Risk-Management for your IT supply chain: from the regulatory obligations under NIS2 and DORA to the assessment of cloud providers (CSA CAIQ/CCM/STAR) and AI providers (CSA AI Controls Matrix v1.1).
Deep Dives
In-depth knowledge pages on the topics that currently raise the most questions — with verified sources and concrete measures.
ISO 27001 × ISO 27090
How to combine ISO/IEC 27001 and ISO/IEC 27090 into one ISMS: nine phases from the combined gap analysis through the measures plan, roadmap, implementation, migration and training to the internal audit, management review and optional certification audit — with a mapping navigator and gap check.
View knowledge pageBaFin AI guidance
On 18 December 2025, BaFin published its non-binding guidance on ICT risks in the use of AI at financial entities. It is designed to help implement DORA’s requirements on ICT risk management and ICT third-party risk management for AI systems as well — along the entire AI lifecycle and with a case study on an LLM-based AI assistant. Throughout, this page separates what DORA and the RTS require, what BaFin describes as proven practice and what we recommend on top.
View knowledge pageEBA Third-Party Risk Guidelines
With EBA/GL/2026/09, the EBA replaces its 2019 Outsourcing Guidelines with a framework for the entire third-party risk arising from non-ICT services — focused on critical or important functions, a register modelled on the DORA register of information and a two-year transitional period. This page puts the Guidelines in context, draws the line to DORA and makes the requirements tangible with a Scope Navigator, a Register Builder and a Readiness Radar.
View knowledge pageOSCAL — Frameworks as Code
The NIST standard that turns regulations, standards, and frameworks from PDF into data: catalogs, profiles, mappings, and evidence — machine-readable, versionable, automatable.
View knowledge pageSupply Chain Security
How to systematically assess and manage the security of your IT, cloud, and AI supply chain – from supplier selection through to continuous monitoring.
View knowledge pageISO/IEC 42001 in Practice
With ISO/IEC 42001:2023, an international, certifiable standard for an Artificial Intelligence Management System (AIMS) exists for the first time. What the standard requires, what the documentation landscape looks like — and how you can efficiently integrate an AIMS into your existing ISMS.
View knowledge pageAI Act Transparency Obligations
From August 2, 2026, the transparency obligations of Art. 50 AI Act apply to interactive AI systems, generative content, emotion recognition and deepfakes. The European Commission's draft guidelines of May 8, 2026 specify how providers and deployers are expected to implement these obligations.
View knowledge pageNIST AI RMF & Cyber AI Profile
Risk management for AI the NIST way: the AI Risk Management Framework and the new Cyber AI Profile (NIST IR 8596) give organizations a structured, prioritized framework for securing AI systems, using AI for defense and thwarting AI-enabled attacks.
View knowledge pageISO/IEC 27001
What the standard requires, how the path to certification works and why an ISMS based on ISO/IEC 27001 holds up as evidence towards customers, partners and supervisory authorities.
View knowledge pageIT-Grundschutz
How the BSI standards, the IT-Grundschutz Compendium and the safeguarding approaches interact – and what the ongoing modernisation towards Grundschutz++ means for your ISMS.
View knowledge pageISO/IEC 27701
How to turn the handling of personal data into a certifiable management system – and what the independently certifiable revision ISO/IEC 27701:2025 means for ISMS operators and data processors.
View knowledge pageTISAX
How the automotive industry's assessment and exchange mechanism works: from governance by the ENX Association and the VDA ISA catalogue to assessment levels, labels and three years of validity.
View knowledge pageIntegrated Management Systems
How to merge ISO/IEC 27001, 27701 and 42001 as well as ISO 9001 and ISO 22301 into a single management system based on the Harmonized Structure – from document control to the combined certification audit.
View knowledge pageNIS2
What Directive (EU) 2022/2555 requires of essential and important entities – and how Germany has implemented it in the BSIG through the NIS2UmsuCG.
View knowledge pageDORA
What Regulation (EU) 2022/2554 requires of financial entities and their ICT service providers – the five pillars, TLPT, the register of information and the oversight of critical third-party providers at a glance.
View knowledge pageCyber Resilience Act
What Regulation (EU) 2024/2847 requires from manufacturers, importers and distributors of products with digital elements – from security by design and SBOM to the reporting deadlines starting 11 September 2026.
View knowledge pageSecure by Design Playbook
A deep dive into ENISA's free implementation guide of 30 July 2026: 22 principles as one-page playbooks with checklists, minimum evidence and release gates – including machine-processable attestation and an indicative CRA mapping.
View knowledge pageEU AI Act
Risk classes, deadlines after the Digital Omnibus, roles and penalties: what Regulation (EU) 2024/1689 means for businesses – as of July 2026.
View knowledge pageKRITIS
What operators of critical facilities must implement under the amended BSI Act and the KRITIS-Dachgesetz – from thresholds and attack detection to verification obligations.
View knowledge pageMDR Cybersecurity
Which cybersecurity requirements the MDR imposes on manufacturers – and how MDCG 2019-16, IEC 81001-5-1 and the AI Act set the framework for the entire product life cycle.
View knowledge pageAI Compliance
How to build an AI governance program in a structured way – from the AI inventory through risk classification and AI literacy to lifecycle controls along the AI Act, ISO/IEC 42001, the NIST AI RMF and BSI AIC4.
View knowledge pagevCISO & External ISB
What distinguishes a CISO from an ISB, what requirements ISO 27001 and NIS2 place on assigning the role – and when filling it externally as a vCISO or vISB makes sense.
View knowledge pageGRC as a Service
How managed GRC models organise the ongoing operation of ISMS, risk management and compliance evidence – from the service components and meaningful metrics to the limits of transferring responsibility.
View knowledge pageAudits & Certifications
How ISO certifications actually work: from audit typology through Stage 1 and Stage 2 to surveillance audits, recertification and the accreditation chain behind it all.
View knowledge pageSecurity Questionnaires
How to answer the growing volume of security questionnaires from customer assessments and third-party risk management in a structured way – and request them purposefully – using standard catalogs, answer libraries, AI-assisted answer generation and a trust center.
View knowledge pageTrust Center
How to provide certificates, attestations, subprocessor lists and pentest summaries in a structured way – publicly where possible, NDA-protected where necessary.
View knowledge pageWhitepapers for download
Each whitepaper has its own page with details and a direct download form.
DORATLPT per DORA: How to Truly Protect Your Crown JewelsGo to whitepaper page 
BSI Grundschutz++BSI Grundschutz++ Methodology & ISO 27001 Upgrade PathGo to whitepaper page 
EU CRACRA Reality Check — Zero-Days, Supply Chain & AIGo to whitepaper page 
DORADORA Reality Check — Third-Party Risk & Agentic AIGo to whitepaper page 
NIS2NIS2 Reality Check — Registration, Supply Chain & LiabilityGo to whitepaper page 
EU AI ActAI Act Reality Check — High-Risk Deadlines, GPAI & Agentic AIGo to whitepaper page 
EBA / DORAThird-Party Risk für CISOs — EBA Non-ICT Guidelines 2026Go to whitepaper page 
BaFin / DORA / AIKI unter DORA für CISOs — BaFin guidance on ICT risksGo to whitepaper page Latest news on this topic area
All newsGRC Engineering Christmas Workshop on 12 December: seven talks, one lunch, 20 seatsOn Saturday, 12 December 2026, VamiSec invites you to the GRC Engineering Christmas Workshop in Sankt Augustin near Bonn. In seven talks, Valeri Milke shows how NIS2, the CRA and the AI Act come together in an integrated management system, what a GRC graph makes visible, how supply chain and cyber risks can be assessed in euros – and how the migration to post-quantum cryptography starts with the CBOM. Free of charge, by personal invitation only.VamiGRC Christmas Bootcamp on 12 December: agentic GRC engineering – on site and liveSeven doors, one morning: on Saturday, 12 December 2026, from 10:00 to 14:00 CET, Valeri Milke and the VamiSec team show how agentic GRC engineering makes NIS2, the CRA, the AI Act and supply chain risks manageable – plus a Christmas special on post-quantum cryptography and CBOM. On site in Sankt Augustin near Bonn or live on LinkedIn and YouTube, free of charge.BaFin AI Guidance: What Banks and Insurers Should Now Implement for ICT Risks under DORAOn 18 December 2025, BaFin published its guidance on ICT risks in the use of AI. It is non-binding, but across 38 pages it shows how financial entities can apply DORA’s requirements to AI systems — from governance through testing and cloud contracts to incident reporting. We have analyzed it and published an interactive knowledge page plus a CISO whitepaper.EBA Guidelines on Third-Party Risk 2026: What Financial Entities Now Need to Know about Non-ICT Service ProvidersOn 18 September 2026 the EBA replaced its 2019 Outsourcing Guidelines with EBA/GL/2026/09. Every recurring non-ICT service that supports a function now falls within a DORA-consistent framework — complete with a register, a catalogue of contractual clauses, subcontracting rules and a two-year transitional period. We have worked through the Final Report and published an interactive knowledge page together with a CISO whitepaper.VamiSec on site in Tallinn: Trust Services and eID Forum & CA-Day 202615–16 September, Kultuurikatel Tallinn: ENISA, the European Commission, D-Trust and TÜV NORD Cert gather Europe's trust community — eIDAS 2.0, EUDI Wallet, European Business Wallet, CRA cross-overs and post-quantum. We are there and translate what it means for your compliance.MID-Digitale Sicherheit: 50% grant for pentests, training & baseline IT protectionNew overview page: the NRW programme funds IT security measures with a 50% grant (€4,000–15,000) — from as-is analysis with penetration testing to security training and the initial purchase of hardware & software. Awarded in a monthly lottery via NRW.BANK — we support you from expression of interest to proof of use.MID-Digitalisierung: 50% grant for developing digital productsThe NRW programme funds external services for developing marketable digital products built on key technologies such as AI with a 50% grant (€4,000–15,000), awarded in a monthly lottery. VamiSec develops as your contractor with security by design plus CRA and AI Act conformity from the first sprint.Up to €15,000 in grants: GRC consulting via MID-Digitale Prozesse (NRW)The NRW state programme “Mittelstand Innovativ & Digital” funds external consulting for digitalising your GRC processes — from NIS2, CRA, EU AI Act and ISO 27001 gap analyses to roadmap, tool selection and VamiGRC implementation. The grant can cover up to 100% of the consulting. 2026 call: applications from 7 Sep to 1 Dec 2026 via NRW.BANK — we guide you through the entire funding process.VamiSec is an accredited PECB Training Partner — 300+ official certifications (ISO 27001, NIS 2, EU AI Act & more)VamiSec GmbH is an accredited PECB Training Partner, delivering 300+ internationally recognized certifications — from ISO 27001 and NIS 2 to the EU AI Act — taught by active Lead Auditors who live these standards in client projects every day.Grundschutz++ now available as a consulting serviceWe now offer Grundschutz++ as an integrated consulting service — the combination of BSI IT-Grundschutz and ISO 27001, delivered within the Vami IMS framework. One management system, two certification goals, no duplicate effort.VamiSec officially certified to ISO/IEC 27001:2022VamiSec is now officially certified to ISO/IEC 27001:2022 — issued by Proks Certification GmbH. Scope: information security consulting services, digital products, and the processing of client data. Information security and compliance as the foundation of trust.
Compliance as a system, not a binder
In an initial consultation, we show you how your standards and regulatory requirements converge into one integrated, audit-ready management system.