CISIS12 is an Information Security Management System (ISMS), which is developed, published, trained and distributed by the IT-Security and safety Cluster. It is the result of a ten year development period. CISIS12 is based on the experiences accumulated from the previous versions. The managementsystem is structured simple and comprehensible, even for newcomers it is easily understandable and logical to use. Results can be generated very quickly, which are well suited for a stable and robust management system to be brought to life in a relatively short time.

CISIS12 stands for Compliance and Informationsecurity in twelve steps. The framework enables organisations to roll out information security processes both horizontally and vertically. It is designed to be scalable and helps to set up and maintain an understandable, accepted and appropriate security structure in KMO.

We strongly recommend the use of a supporting software for CISIS12®. We have therefore contracted with various software manufacturers for the use of ISIS12/CISIS12®. You can currently find these under the Software section of the ISIS12 website.

The following information on the individual solutions comes from the self-descriptions of the providers. We endeavour to provide a list as complete as possible. However, we can neither express a recommendation nor currently provide information on the specific functions in each case. We therefore ask the consultants to contact the software companies in each case.

Consultants are trained and recertified exclusively through the IT security cluster. They are appointed, confirmed and recertified in their role as consultants. To become a consultant, the following requirements apply:

• Certification as ISO/IEC 27001-Auditor or as IT baseline auditor, OR
• At least 5 years of relevant professional experience in the field of IT, of which at least 4 years must have been in the field of information security, OR
• Completed studies in the field of IT and/or information security + at least 4 years work experience in the field of information security.

The information is obtained via a questionnaire/self-disclosure and is reviewed by an expert panel of the IT security cluster. If one of the three requirements is met, a five-day course on CISIS12 must be attended. This concludes with a 90-minute exam (online) at the ICO (Multiple Choice, closed book). If the exam is passed, the the board/managing director of the IT Security Cluster gives a certificate and a consultant role.

If there is a valid ICO-Advisor certificate, it must be upgraded for the consulting of CISIS12. For this purpose, a two-day training course is attended at Cluster. This concludes with a 60-minute exam (multiple choice, closed book) at the ICO. If this is passed and the consultant commits to attending three further training workshops per year, the CISIS12-Consultant role will be granted by the managing directorship/CEO of the IT security cluster.

Software companies can contact at any time Nicole Eckl, Nicole.Eckl[ -/ @ -/ ]it-sicherheitscluster.de.

Preliminary information: In order to integrate the CISIS12® catalogues into software or to programme CISIS12® software, a software licence agreement between the software company and the IT security cluster is required. Without this, CISIS12® information and processes may not be used in software.

https://cisis12.de/tools/