Most ISMS tools can hold a control list. The differences show up later: when the auditor asks for last year’s management review, when the renewal quote arrives, or when you want to leave. Here are four criteria that hold up over a full certification cycle, and where devguard sits among the options.
Put them to every vendor on your shortlist, us included. The answers matter more than the feature list.
Your auditor wants to see how the Statement of Applicability, the risk register, management reviews and nonconformities changed over time. Ask whether every version is kept and dated, or simply overwritten.
Ask where customer data is hosted, where AI features run, and which subprocessors are involved. If GDPR or the nFADP matter to your customers, also ask whether on-premise is possible at all.
A certificate runs for three years, so compare what you pay across all three, not the first invoice. Look for a published price, what it includes, and how renewals are priced.
Check that you can export everything in standard formats, how much work a move in or out takes, and whether anyone helps with it. For evidence automation, check the connectors against your own stack rather than counting them.
devguard is a Swiss-hosted ISMS workspace from devguard AG in Bülach. Customer data stays in Switzerland, AI features run in the EU (Frankfurt), and on-premise is possible. ISO 27001, SOC 2, GDPR and the nFADP run on one control set, with automated cloud evidence for AWS, Azure, GCP and Exoscale. There is a free plan and a Business plan at CHF 199 a month, and a move from an existing tool is done by hand, scoped in a conversation. It suits teams that want Swiss hosting, a predictable price and help with the move; if your stack needs connectors beyond those four clouds, ask us before you decide.
A spreadsheet can pass an audit, and plenty of organizations certify that way. Software pays off between audits: keeping reviews, risks and evidence current, and showing the auditor what changed and when. If your ISMS is small and one person keeps it running, a spreadsheet may be enough for now.
It depends on the number of users, how many frameworks you run, and how the price moves at renewal, so ask for the year three figure as well as year one. Some vendors publish prices, many quote case by case. As one data point, devguard publishes its price: a free plan, and Business at CHF 199 a month.
That depends on what your tool lets you export. Ask for a full export in standard formats before you sign, and plan any move so the old setup stays live until you have checked the new one side by side. Our page on switching your ISO 27001 tool at recertification describes how we approach it.
Bring your shortlist and your stack. In a short conversation we go through the four questions above for devguard, including where it does not fit.