Compliance

ISO 27001 & BSI: both hinge on a complete asset inventory.

ISO/IEC 27001:2022 with its 93 Annex A controls and BSI IT-Grundschutz with its building-block concept have substantial overlap. And a shared bottleneck. LOGINventory closes it agentlessly and audit-ready. What the software doesn’t do, we name just as clearly.

Start your trial license → Discovery call (15 min)

last_check: 09:47:12

Control	BSI building block	Delivers
A.5.9 Asset register	OPS.1.1.1	Reports
A.5.18 Access rights	OPS.1.1.5	Reports
A.8.8 Vulnerabilities	OPS.1.1.3	Cyber Insight
A.8.9 Configuration Mgmt	OPS.1.1.3	Reports
A.8.32 Change Control	OPS.1.1.3	Audit trail

What you get

The ISMS building blocks that auditors almost always require.

Asset register

A.5.9 / OPS.1.1.1.

Complete, well-maintained inventory. Clients, servers, switches, agentlessly. OPS.1.1.1 (IT-Grundschutz-Kompendium, 2023 edition) explicitly recommends ITAM tools.

Permissions auditing

A.5.18.

Reports for access rights, user overview, AD groups. Resolved recursively. GDPR folders with permissions on shares, databases, partition encryption.

Vulnerability tracking

A.8.8 / OPS.1.1.3.

Daily CVE matching with Cyber Insight from version 2025.2. Handling status per vulnerability documentable. The foundation auditors typically require.

Vulnerability module →

How it works

Two standards, one data foundation. The mapping table does the rest.

Certification is voluntary. And a de facto requirement.

An information security management system (ISMS) under ISO 27001 is officially voluntary, but a de facto requirement for NIS2-regulated organizations, critical infrastructure operators under §8a BSIG, financial institutions (BAIT/VAIT), and suppliers to large enterprise customers. BSI IT-Grundschutz has been mandatory for federal agencies since December 6, 2025. And a recognized security framework for everyone else.

The BSI provides an official mapping table that cross-references ISO 27001 controls and IT-Grundschutz building blocks. That’s the starting point for any parallel implementation. Anyone serving both standards collects evidence once. And maps it to both worlds via the table. In IT-Grundschutz, the asset inventory also serves as the data foundation for the structure analysis.

ISO 27001 and NIS2 aren’t the same thing. NIS2 imposes additional requirements. Particularly around reporting timelines (24h / 72h / 1 month). An ISO certification doesn’t replace NIS2 compliance.

Which controls we cover

Annex A controls directly, plus DER.4 for emergency management.

A.5.9 / OPS.1.1.1

Asset register

Complete, well-maintained inventory. Clients, servers, switches, agentlessly. Even decommissioned devices stay traceable in the archive.

A.5.18 / OPS.1.1.5

Access rights

The “User Access Rights”, “User Overview”, and “Group Overview” reports, with AD groups resolved recursively, plus a 4-role model for LOGINventory itself.

A.8.8 / OPS.1.1.3

Vulnerability management

Cyber Insight integration from V2025.2. Daily CVE matching, criticality levels, documentable handling status.

A.8.9 / OPS.1.1.3

Configuration Management

Client, server, and switch reports capture hardware, OS, network parameters, server roles, RAID, partitions, port assignments, VLANs.

A.8.32 / OPS.1.1.3

Change Control

Change log active by default. “Changes” tab filterable by timestamp. Archived assets keep their history.

DER.4

Emergency management

Built-in emergency manual based on the BSI template, as a dynamic document. All inventory data updates automatically when it’s opened.

The ISO 27001 template. A template, not automation

LOGINventory includes a built-in table listing relevant ISO 27001 controls and how they can be implemented with the software. This template must be filled in manually. No data sources are connected. The template structures the compliance officer’s work; it replaces neither the substantive assessment nor the certification itself.

What we’re not

A clear boundary. No ISMS, no SIEM, no penetration testing.

Not covered

○No ISMS. No risk management process, no risk-based evidence documentation
○No risk assessment engine
○No auto-fill for the ISO 27001 template. Manual only
○No security monitoring, no SIEM, no SOC replacement

Also not

○No penetration testing
○No awareness training or training functions
○LOGINventory is not itself certified to ISO 27001 or IT-Grundschutz

Ways to get started

See LOGINventory in your own IT environment.

Pick what fits your week. Every route is non-binding.

Trial license

30 days. Full feature set.

Full network size, all modules, no credit card. Setup in under 30 minutes.

Request trial license →

Discovery call

15 minutes. With a technician.

You describe your environment: size, sites, what you want to solve. We tell you whether LOGINventory is the right tool for it.

Schedule a time →

Forever-Free

20 devices. No time limit.

Small environment? Lab? Personal project? Works without a contract, without a lead.

Download directly →