CHInformation security for SMEs & the public sector
Built around ISO 27001. Every gap always in view.
Assets, risks, measures and evidence in one system that follows the standard. The readiness check shows you at any time where you stand ahead of the certification audit – so you become audit-ready faster, without last-minute firefighting.
Every uploaded file is scanned for malware before it is stored.
HOW IT WORKS
From the first step to the audit.
Tell Varmo about your organisation. From then on, the standard sets the pace, and Varmo always shows you the next step.
01
Tell us about your organisation.
Name, issues, interested parties, roles and team: this is where clause 4 begins. The setup assistant (“Set up ISMS” in the app) guides you through the build in 22 steps.
Set up ISMS · Organisation
Name of the organisationLorvan Feinmechanik AG
Existing ISMS documentsNo, we are starting from scratch
Read and acknowledge policyAccess and authorisation management policy (v1)Luca Fischer · Employeesby 28 Nov
+ 9 more
03
Implement together.
Policies, documents and the Statement of Applicability go through your approval workflow, always according to the four-eyes principle. Every page shows whose turn it is next.
Policies
Access and authorisation management policyVersion v1 · submitted by Sandra Keller (ISMS manager)
Draft
In review
Valid
Approval workflowTop management: Daniel BrunnerSignature pendingsignedFour-eyes principle: whoever created or submitted the version does not sign it themselves.
Version v1 is validNext step: employees acknowledge the policy.
04
Audit-ready.
The readiness check shows per clause what has been fulfilled and, for each gap, the likely finding. Internal audit and management review are in the same system.
Readiness check from the Starter plan, as a self-assessment.
ISO/IEC 27001 readiness checkfrom Starter
96%%
Overall status · previously 43%Ready
6 Planning90%
9 Evaluation100%
Annex A92%
Ready for the certification auditSelf-assessment
Internal audit 2026 completed
Management review 2026 approved
ISO/IEC 27001 · READINESS CHECK
Built around the standard. Checked before the auditor arrives.
Varmo does not reduce ISO/IEC 27001 to a checklist but maps it as workflows: clauses 4 to 10 in the modules, Annex A through risk treatment and the Statement of Applicability. The readiness check adds a test bench on top that you can run again at any time.
What the readiness check examines
✓26 checkpoints for clauses 4 to 10. Is the scope approved? Have the risks been assessed, the treatment plans approved and the SoA approved and kept up to date? Has there been an internal audit and a management review in the last 12 months?
✓Varmo answers 23 checkpoints from your data. For three checkpoints, such as opportunities or communication, Varmo shows your data first; you confirm with a justification and, if you wish, with evidence.
✓Including Annex A. Applicability assessed, exclusions justified, cross-check without contradictions and implementation level per theme A.5 to A.8.
Expected major nonconformities 0·Minor nonconformities 3
What you get as a result
✓Traffic light per clause and an overall level (clauses 4 to 10 weighted at 75 %, Annex A at 25 %).
✓Likely finding per gap: major nonconformity, minor nonconformity or observation. Six critical checkpoints, including scope, risk assessment and internal audit, count as a likely major nonconformity while open.
✓Gap list with links straight to the place where you close the gap.
✓Report and history: Completed checks freeze the status; the history shows your improvement in percentage points.
The readiness check is a self-assessment and included from the Starter plan. Certification is decided by an accredited certification body.
Database, sign-in, malware scanning and error tracking run on our own servers, without cloud services from US providers.
No trackers
No web analytics and no fonts or scripts from third-party servers.
No AI services
Varmo does not pass your content to any AI service.
Your organisation
TLS
SWITZERLANDData centre in SwitzerlandData, files, backups
Your organisation transmits data encrypted to the data centre in Switzerland, where data, files and backups are stored.
1Note 1: Exception for card payments: Stripe (Stripe Payments Europe Ltd., Ireland, part of a US group) only receives your billing details, never your ISMS content. If you pay by invoice, no data goes to Stripe.
2Note 2: Integrations that you switch on yourself (e.g. Microsoft, JIRA, ServiceNow) connect Varmo with the respective provider.
You can run an ISMS with spreadsheets, file shares and email. The effort then goes into coordination: whose turn is it? Which version applies? Where is the evidence? Varmo connects these steps into one workflow.
ISMS software instead of Excel: working with Excel, Word and email compared with working in Varmo
Task
With Excel, Word and email
With Varmo
Order according to ISO/IEC 27001
plan it yourself
Assistant with 22 steps along clauses 4 to 10
Evidence for a requirement
search through folders and file shares
Evidence attached directly to the measure, internal control and requirement, as a file or link
Exceptions
approved once, never reviewed again
time-limited, with a risk, approval workflow and reminder before expiry
Four-eyes principle
organisational, not enforced
without exception; submitting is blocked if nobody else can approve
Whose turn is it?
ask by email
Tasks per person, “What happens next?” on every workflow page
Centrally maintained frameworks for ISO/IEC 27001, NIST CSF 2.0, NIST SP 800-53, NIS2, DORA and the Swiss frameworks – ICT baseline protection (Switzerland), the ICT Minimum Standard (Switzerland), FINMA Circular 2023/1 and data security under the FADP/DPO – with revisions and new editions that you adopt step by step. From Pro, mappings show where standards overlap. Identical requirements count as fulfilled, and the coverage view shows the gaps.
✓Add your own frameworks, import them via CSV from Starter
✓Compare coverage per standard (from Pro)
Coverage by functionSample data
ISO/IEC 27001NIS2
RISK MANAGEMENT
Assess, treat and own your risks.
You record risks as soon as they arise, link them to an asset and a threat and assess them by likelihood and impact. The highest result across all security objectives is decisive.
✓Your own or a predefined risk methodology (e.g. BSI Standard 200-3)
Four phases, one cycle. Every module has its place in the flow of the standard, and they all work together: a risk knows its asset, a measure knows its requirement.
The four phases repeat: after “Review and improve”, the next cycle starts again at “Build”.
01 · Build · Clauses 4, 5 and 7
Lay the foundations.
Guided setup & tasksThe assistant guides you in 22 steps from context and scope to your first assets. After that, everyone sees their tasks.
Roles & approvalsFunctional roles with permissions, segregation of duties and the four-eyes principle without exception.
Assets & protection requirementsInventory with owners, protection requirements per security objective, inherited through the dependency chain.
Data comes from the systems you already use. Varmo only reads from JIRA, ServiceNow and Intune and changes nothing there. Every integration has its own guide.
Microsoft, Entra, Intune and Teams are trademarks of Microsoft Corporation; JIRA is a trademark of Atlassian; ServiceNow is a trademark of ServiceNow, Inc. Their mention does not imply a partnership.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.
Maturity levels according to the Swiss ICT Minimum Standard, NIS2 and NIST CSF, dependencies on service providers and a clear process for security incidents.
FINMA Circular 2023/1 and DORA as frameworks, obligations per organisation, system and service provider, and reports to authorities within the statutory deadlines.
See the solution
Executive management
✓Management review with a traffic light per topic
✓Approval of the scope and the Statement of Applicability
✓Risk acceptance against defined criteria
ISO, CISO, ISMS managers
✓Setup assistant for building the ISMS
✓Tasks instead of reminder emails
✓Implementation status per requirement and framework
Head of IT
✓Baseline checks per system with evidence
✓Measures, recurring measures and internal controls with due dates
✓Time-limited, approved exceptions
Employees
✓Report risks and security incidents easily
✓Read and acknowledge policies
✓See only what they need for their job
Frequently asked questions
What is Varmo?+
Varmo is ISMS software (information security management system) for SMEs and the public sector, built from the ground up around ISO/IEC 27001. Assets, protection requirements, risks, measures, exceptions, policies, audits and the management review live in one system and are linked to the requirements of the standards you choose.
Which standards are supported?+
Currently ISO/IEC 27001:2022 (Annex A), NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev. 5, NIS2, DORA and the Swiss frameworks: ICT baseline protection (Switzerland), the ICT Minimum Standard (Switzerland) with maturity levels, FINMA Circular 2023/1 and data security under the FADP/DPO. You can add your own frameworks and internal requirements yourself, and from the Starter plan also import them via CSV. From the Pro plan, mappings between ISO/IEC 27001, NIST CSF, NIST SP 800-53, NIS2, DORA, ICT baseline protection (Switzerland), the ICT Minimum Standard (Switzerland), FINMA Circular 2023/1 and data security under the FADP/DPO show where one implementation covers several requirements.
Does Varmo replace certification?+
No. Certification to ISO/IEC 27001 is carried out by an accredited certification body. The software shows you your implementation status, keeps the evidence for each requirement and produces the Statement of Applicability (SoA) as a report.
Where is our data stored?+
Your ISMS data is stored in Switzerland, including backups, with a Swiss provider that has no US parent company. Only if you pay by card does Stripe receive your billing details, never your ISMS content. Each organisation’s data is strictly separated, and even the operator only sees it if you grant time-limited, read-only support access. Details are on the Security page and in the privacy policy.
Does the software help with data protection under the FADP?+
Yes. In the protection requirements assessment, you record personal data and sensitive personal data, and for systems the characteristics of the processing. From this, the software produces a reasoned proposal under the Swiss Federal Act on Data Protection (FADP) on whether a data protection impact assessment is required; you carry out the DPIA directly in the software, and your data protection advisor approves it.
How much effort does getting started take?+
A setup assistant guides you through the build in 22 steps: organisation, context, approvals, risk methodology, requirement frameworks, asset structure and the first assets. Each step explains what it is about and why. You open your account yourself and try it free for 30 days with every feature.
What is the difference between ISO 27001, NIS2 and NIST CSF?+
ISO/IEC 27001 is a certifiable standard for an information security management system. NIS2 is an EU directive with legal obligations for certain entities in the EU. The NIST Cybersecurity Framework is a voluntary framework that organises cybersecurity into six functions. Many requirements overlap; one implementation can satisfy several of them.
How long does ISO 27001 certification take?+
Many SMEs expect six to twelve months from the start to the certificate, depending on where they begin. The ISMS has to be operated for a while before the audit, including an internal audit and a management review. The readiness check (from Starter) shows where you stand.
What is a Statement of Applicability (SoA)?+
The Statement of Applicability (SoA) is a mandatory document under ISO/IEC 27001. It lists all controls from Annex A, whether they are applied, why, and whether they are implemented. In Varmo, it is generated from your data and approved according to the four-eyes principle.
Can we manage several organisations?+
Yes, from the Pro plan. Under one account you manage several organisations, for example subsidiaries, sites or departments. The data stays strictly separated, and you manage members centrally. Starter includes one active organisation; archived organisations are kept.
Can we get our data back?+
Yes. You can request a complete export of your organisation as a ZIP file at any time, including uploaded files. After cancellation, the data is deleted completely once the agreed deletion period has expired.
What does Varmo cost?+
There are three plans: Starter, Pro and Ultimate for individual requirements. Every account starts with a 30-day trial with every feature, free of charge and without a credit card; after that, you choose Starter or Pro. If you don’t buy, your account continues free of charge with limited features, and your data is kept. You will find the plans and how they differ on the pricing page. In a demo, we are happy to show you which plan suits your organisation.
Your path to ISO/IEC 27001 at a glance.
In a personal demo, we show you Varmo based on your questions, from the setup assistant to the readiness report – with no obligation.
✓A tour from the setup assistant to the readiness report
✓An assessment of your path to ISO 27001 certification
