Skip to content
Varmo
DeutschSign inRequest a demo
FEATURES

Every feature for your ISMS.

Varmo supports the whole lifecycle of an ISMS under ISO/IEC 27001: build it, assess risks, implement, review and improve. The modules work hand in hand: a risk knows its asset, a measure its requirement, an exception its risk.

Request a demoTry it free
01 · BUILD

Organisation, roles, policies and assets.

  • Setup assistant with the progress bar “19 of 22 steps” and the next step with an explanation and a “Do it now” button.

    Guided setup & tasks

    A setup assistant with 22 steps along ISO/IEC 27001, tasks for every person and “What happens next?” in every workflow.

  • Asset inventory with search and filters: applications such as the ERP and CAD systems and cloud services, each with status, protection requirements and owner.

    Assets & protection requirements

    An inventory with owners, protection requirements analysis with approval and a baseline check per system that matches its protection requirements.

  • Policy “Access and authorisation management” in review, as seen by the submitter: version 1 is waiting for the signature of top management.

    Policies, documents & evidence

    Policies with approval workflow, versions and acknowledgement; documents and evidence with versions and four-eyes approval.

  • Functional role “Risk analyst” with the assigned person and permissions per area, each for all assets or only for the person’s own assets.

    Roles & approvals

    Functional roles with fine-grained permissions, four-eyes approvals without exception, segregation of duties and several organisations per account (from Pro).

02 · ASSESS

Assess risks and data protection.

  • Risk register with level, status, risk owner and date of the next review.

    Risk management

    Report risks, assess them with your methodology, treat them and accept them against defined criteria, with a risk treatment plan.

  • Approved data protection impact assessment of the HR and payroll system with the result “Possible increased risks” and the description of the processing under Art. 22 FADP: purpose, data subjects, recipients and retention.

    Data protection & DPIA

    Record personal data per system, check whether a DPIA is required under the Swiss FADP and create the data protection impact assessment directly in Varmo.

03 · IMPLEMENT

Meet measures, internal controls and requirements.

  • Internal control “Effectiveness of the data backup” with its frequency and every run including the result.

    Measures & internal controls

    Implement measures, carry out recurring measures and internal controls with evidence, and approve time-limited exceptions through an approval workflow.

  • Approved version 1 of the Statement of Applicability (SoA) for ISO/IEC 27001 Annex A: approval by top management, key figures on applicability and implementation, reason and approver.

    Requirements & SoA

    Adopt frameworks, justify applicability, evidence implementation and version your Statement of Applicability (SoA) with approval.

    Custom catalogues in all plans · standard catalogues from Starter · cross-check and coverage from Pro

  • Integrations

    Calendar feed, evidence links, import from CSV, Jira and ServiceNow, Microsoft 365 (Entra ID, Teams, Intune), REST API and webhooks – each with a guide.

04 · REVIEW AND IMPROVE

Audits, readiness, incidents and management review.

  • Report of the 2026 management review with a traffic light per topic under ISO/IEC 27001 9.3.

    Audits & ISMS governance

    Context, objectives, training, internal audit, findings with effectiveness review and management review under ISO/IEC 27001 9.3.

  • Report of a completed ISO/IEC 27001 readiness check: overall status 81 per cent, partly ready, no expected major nonconformities.

    ISO/IEC 27001 readiness check

    How close are you to certification? Checks clauses 4 to 10 and Annex A, with a traffic light per clause, likely findings and a report. From Starter.

    Included from the Starter plan
  • Security incident “Antivirus reports a finding on a measuring computer” in progress, with the next step, the assessment and the log.

    Security incidents

    Report, assess, handle and follow up incidents, including the decision on the reporting obligation where personal data is involved.

ALSO INCLUDED

More features.

  • Exceptions

    Time-limited deviations with a linked risk, approval workflow and a reminder before they expire.

  • Import by CSV

    From Starter: take over risks, measures, exceptions, assets, findings and custom catalogues with a preview, conflicts and undo.

  • Exports and printing

    Lists as CSV, reports such as the SoA, treatment plan and management review printable as PDF.

  • Several organisations

    From Pro: several organisations under one account, such as subsidiaries, sites or departments, with strictly separated data.

How close are you to ISO/IEC 27001?

In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.

Request a demoTry it free