Skip to content
Varmo
DeutschSign inRequest a demo
COMPARISON

ISMS software compared: spreadsheets, document storage, GRC suite or Varmo

An ISO/IEC 27001 ISMS can be run in several ways. Which one fits depends on size, requirements and the people who look after it. This comparison sets out the differences objectively – and where Varmo stands.

Request a demoTry it free
WHICH APPROACH FITS?

Every approach has its place.

What matters is how many people are involved, which requirements apply and how much time is left for coordination.

  • Excel and Word

    Suits a first start with few people involved, when one person keeps the overview and templates already exist.

  • Document storage

    Suits organisations that mainly want to file, version and share policies and evidence in an orderly way.

  • Large GRC suite

    Suits groups with many companies, their own GRC team and a budget for implementation and customisation.

  • Varmo

    Suits SMEs and public bodies that want to run an ISO/IEC 27001 ISMS with defined workflows: open an account yourself, start with the setup assistant, hosting in Switzerland.

THE APPROACHES AT A GLANCE

Four approaches, seven questions.

The statements on spreadsheets, document storage and GRC suites describe typical ways of working; individual cases may differ. The statements on Varmo refer to its current features.

  • Day-to-day effort

    Excel and Word
    Lists, deadlines and reminders are maintained by hand; whose turn it is gets settled by email.
    Document storage
    Documents are well organised; tasks, deadlines and responsibilities are handled outside the storage.
    Large GRC suite
    Very extensive and highly customisable, usually with an implementation project and consultants.
    Varmo
    Tasks arise from the workflows; everyone sees their tasks with due dates, and every workflow page shows “What happens next?”.

  • Evidence for the audit

    Excel and Word
    Evidence sits in folders and emails; the link to each requirement is maintained by hand in the spreadsheet.
    Document storage
    Document versions are traceable; the link to risks and requirements is usually kept elsewhere.
    Large GRC suite
    Comprehensive, depending on configuration.
    Varmo
    Evidence is attached to measures, controls and requirements; the SoA is built from it and shows when it is out of date.

  • Approvals and four-eyes principle

    Excel and Word
    Approvals by email or signature; proving that a second person reviewed something takes effort.
    Document storage
    Depending on the storage, a simple approval step; segregation of duties is rarely enforced.
    Large GRC suite
    Approval workflows are usually fully configurable.
    Varmo
    Four-eyes principle without exceptions: nobody approves their own work, and submitting is blocked if nobody else could approve.

  • Frameworks and multiple credit

    Excel and Word
    Requirements are entered by yourself and updated by hand for each new edition.
    Document storage
    No frameworks; requirements sit in individual documents.
    Large GRC suite
    Usually many frameworks, partly as add-on modules.
    Varmo
    9 centrally maintained frameworks (ISO/IEC 27001 Annex A from Starter, all from Pro); equivalent or contained requirements count as met automatically (from Pro).

  • Data export and lock-in

    Excel and Word
    The files stay with you; connections often live in references and formulas.
    Document storage
    Documents can be downloaded; workflows and decisions are rarely stored with them.
    Large GRC suite
    Export options and contract terms vary by provider.
    Varmo
    Full export as a ZIP file with all data and files, lists as CSV, REST API from Pro; cancel at any time to the end of the billing period.

  • Data location

    Excel and Word
    Wherever you save the files: on your own network or in your cloud storage.
    Document storage
    Depending on the storage, on your own network or in a provider's cloud.
    Large GRC suite
    Depends on the provider; location and ownership need checking case by case.
    Varmo
    Hosting in Switzerland, backups included, with a provider without a US parent company.

  • Price and getting started

    Excel and Word
    Licences are usually in place; the effort lies in working time.
    Document storage
    Often already in place; you build the ISMS workflows yourself.
    Large GRC suite
    Prices usually on request, plus implementation and training.
    Varmo
    Public prices, monthly or yearly; try free for 30 days with every feature, no credit card required.

You bring existing lists over with the CSV import, and policies and the SoA you have already approved together with their date.

NO LOCK-IN

Your data stays your data.

You should stay because the ISMS works – not because leaving is hard.

  • Full data export

    A Tenant Admin requests the export and a second person confirms it. The ZIP file contains one JSON file per area, a table of contents and every uploaded file; it is available for download for 7 days.

    Data export guide

  • CSV in both directions

    Export the risk register, risk treatment plan, SoA and other lists as CSV. Bring existing Excel lists over with the CSV import (from Starter).

    CSV import

  • REST API and webhooks

    Other systems read and create data through the REST API, with access per key; webhooks report events with a signature (from Pro).

    REST API and webhooks

  • Cancel in the app

    A Tenant Admin can cancel at any time in the app, effective at the end of the current billing period. Export your data by then; once the deletion period has passed, everything is deleted permanently.

    Terms, section 8
SWITZERLAND

Hosting in Switzerland, verifiably.

An ISMS shows where an organisation is vulnerable. That is why it matters where the data is held and who can access it.

  • Data and backups in Switzerland

    Content, files and backups are held in Switzerland, with a provider without a US parent company. The data sovereignty page explains what the US CLOUD Act means and which services are involved.

    Data sovereignty

  • Support only with your approval

    We only see your content if you grant support access: for 24 hours at most, read-only, with every access logged.

    Security
LESS EFFORT DAY TO DAY

What you no longer do by hand.

Concrete examples from the day-to-day running of an ISMS:

  • Setup step by step

    The setup assistant guides you in 22 steps along ISO/IEC 27001, from the context to your first assets; completed steps are ticked off automatically.

    Guided setup & tasks

  • Tasks instead of reminder lists

    Approvals, measures that are due, reviews and expiring exceptions appear as a task for the person responsible, with a link to the place where they are done.

    Measures & internal controls

  • SoA from your decisions

    The Statement of Applicability is built from applicability, justifications, implementation and evidence. If something material changes afterwards, the software shows that the SoA is out of date.

    Requirements & SoA

  • Implement once, get credit several times

    If a requirement is equivalent to or contained in one that is met, the fulfilment is carried over – for example between ISO/IEC 27001, NIST SP 800-53 and NIST CSF 2.0 (from Pro).

    Combine several frameworks

  • Readiness check from existing data

    The software answers most questions of the readiness check from what you record anyway: scope, policy, risks, SoA, internal audit, management review (from Starter).

    Readiness check

  • Bring in existing policies

    Policies already approved outside the software are brought in with their date and evidence; a second person confirms the transfer.

    Policies & documents
PROFESSIONALLY SOUND

Requirements in the wording of the source.

Auditors want to read a requirement as it was issued.

  • DORA and NIS2

    Wording and reference from the Official Journal of the EU, for every requirement.

    DORA

  • FINMA Circular 2023/1

    Requirements in the wording of the margin numbers, mapped to ISO/IEC 27001 Annex A, NIST CSF 2.0 and DORA.

    FINMA Circular 2023/1

  • ICT Minimum Standard (Switzerland)

    The measures in the wording of the Swiss federal government, with maturity levels 0–4 and export to the official Excel tool.

    ICT Minimum Standard

  • NIST in the original

    NIST CSF 2.0 and NIST SP 800-53 stay in the original English, so that no meaning is lost in translation.

    NIST CSF 2.0

  • Reporting deadlines for incidents

    For reports to BACS (Swiss Federal Office for Cybersecurity), FINMA, under DORA and NIS2, the software calculates the statutory deadlines and shows the person responsible what is due next. You file the report itself with the authority.

    Security incidents
FOR SMES AND THE PUBLIC SECTOR

Get started without an implementation project.

Clear plans, clear prices and a start you control yourself.

  • Public prices

    Every plan with its price on the website. Employees who only report and read policies do not count as users.

    Pricing and plans

  • Try free for 30 days

    With every feature, no credit card required. Then choose Starter or Pro – or continue with the limited Free plan.

    Open an account

  • Single sign-on and SCIM

    Sign in through your company's identity service, with people provisioned automatically from Microsoft Entra ID; leavers are blocked immediately (from Pro).

    Entra ID (SCIM)

  • For the public sector and regulated industries

    Dedicated solution pages show which frameworks and workflows suit the public sector, critical infrastructure and financial services.

    Public sector

  • German and English

    Everyone chooses their own language; frameworks with an English version appear in English, while your own content stays as you enter it.

FAQ

Frequently asked questions about the comparison

Is Varmo an alternative to spreadsheets for an ISMS?
Yes. Varmo replaces spreadsheets for assets, risks, measures and the SoA with linked workflows, tasks and approvals. You bring existing lists over with the CSV import and can export lists as CSV again at any time.
Do we need consultants to get started?
Not necessarily. The setup assistant guides you to a working ISMS in 22 steps and explains each one. Information security expertise is still needed; depending on your starting point, a consultant can be useful.
What happens to our data if we cancel?
Until the end of the billing period you keep working as usual and can export all data as a ZIP file. After that, sign-in is blocked; once the deletion period has passed, all data is deleted permanently.
When is a large GRC suite the better choice?
For groups that want to cover governance, risk and compliance across many companies and departments in one system, and that plan a dedicated team and an implementation project for it.

Compare for yourself – with your own data.

Try Varmo free for 30 days with every feature, or let us show you the solution in a demo.

Request a demoTry it free