- NIS2 requires many organizations to set up an ISMS.
- Instead of expensive specialist tools like Verinice or HiScout, Honicon relies on Jira, Confluence & asset management.
- Documentation, risk management, and business continuity can be implemented seamlessly there.
- Benefits: less complexity, lower costs, familiar tools, higher adoption.
- Information security thus becomes part of everyday work – lean, transparent, and future-proof.
Information security is moving ever more into the spotlight. With the implementation of the NIS2 directive, the number of organizations that must establish an information security management system is growing. BSI IT-Grundschutz serves as the benchmark, even if it is often perceived as a hurdle.
The focus quickly turns to specialized software. Names like Verinice, HiScout, QSEC, DocSetMinder, EDIRA, GRASP, INDITOR, ditis InfoSec-Manager, or fuentis Suite dominate the market. They promise order and structure, but often introduce new complexity. New interfaces, new data models, new training. Honicon takes a different approach.
Process consulting as foundation
Honicon is a consulting firm specializing in processes. Experience from many projects shows: Efficiency arises from clear workflows, costs fall by avoiding duplicate work, and speed comes from simple structures. This mindset shapes every engagement.
With the motto “Thinking Forward” Honicon pursues the goal of understanding information security not as an additional silo, but as part of existing structures. Jira, Confluence, and asset management form the foundation for this. These systems have long shaped the daily work of many companies. They manage projects, document knowledge, connect teams. So why not anchor the development of an ISMS there as well?
Alternative to traditional tools
Verinice, HiScout, or QSEC provide tools for risk management, documentation, and evidence. Confluence and Jira can take on the same role. Policies, security concepts, or contingency manuals appear there as pages, with transparent versioning, comments, and permissions in place.
DocSetMinder or ditis InfoSec-Manager rely on structured document management. Confluence reflects exactly this structure, with clear organization, hierarchical spaces, and integrated search.
EDIRA, GRASP, or INDITOR focus on dependencies between processes and systems. Asset management provides a suitable model for this. Systems, applications, processes, and responsibilities appear there with relationships that can be evaluated visually or in tables.
HiScout or QSEC provide workflows for risk management. Jira serves the same purpose. Risks are tracked as tickets, with fields for likelihood of occurrence, impact, and ownership. Dashboards show open risks, automations remind you of deadlines, and changes are fully documented.
Fuentis Suite offers business continuity management. Here, too, the Atlassian ecosystem comes into play. Confluence contains emergency plans, Jira manages measures, and asset management shows dependencies. This creates a holistic picture that stands up to audits and enables action in an emergency.
The comparison shows: Tasks handled by specialized products can be represented in the Atlassian universe—not by imitation, but by leveraging existing strengths.
Lean ISMS in everyday work
An ISMS requires structure, traceability, and transparency. Jira, Confluence, and asset management provide the foundation. Risks are tracked as issues, documentation is created collaboratively, and dependencies remain visible.
Implementation proceeds step by step. First centralize documentation, then establish workflows for risks, and finally model dependencies. Each element interlocks. Information security does not sit alongside day-to-day business, but is integrated into the familiar tools.
A hypothetical example illustrates the approach: A midsize company in the energy sector is required to set up an ISMS under BSI IT-Grundschutz. Instead of introducing Verinice or QSEC, it uses the Atlassian environment that is already in operation. Risks appear as issues in Jira, emergency plans reside in Confluence, and system dependencies are maintained in asset management. The workforce operates in a familiar environment, training effort remains low, and costs decrease.
This illustrated approach shows how an ISMS can be structured in the Atlassian ecosystem without introducing additional software.
New or existing – both are possible
An ISMS is either built on a new instance or grows within an existing environment. Many companies have been working with Jira and Confluence for years. Projects, documentation, and workflows already exist there. Information security fits in seamlessly.
New structures can be set up just as well. Honicon configures Jira, Confluence, and asset management so that they take information security into account from the outset. The systems evolve with the requirements, dashboards evolve, documentation grows, and risks remain visible.
The motto “Thinking Forward“ describes this approach. Information security is not viewed as a rigid project with an end point, but as a dynamic process that continuously accompanies operations.
Conclusion
Information security requires an ISMS that covers standards such as ISO 27001 or BSI IT-Grundschutz. NIS2 increases the pressure to build structures in good time. Specialized products like Verinice, HiScout, or QSEC offer functions that seem indispensable at first glance. Yet they create new silos, increase effort, and drive up costs.
Jira, Confluence, and asset management provide an alternative. They cover documentation, risk management, and business continuity management without introducing additional software. Honicon brings experience from process consulting, sets up systems in a lean way, reduces complexity, and strengthens existing structures.
An ISMS in the Atlassian ecosystem does not automatically meet standards. However, it provides the foundation to design processes so that the requirements of ISO 27001 and BSI IT-Grundschutz are met. For companies that are obliged for the first time under NIS2, this creates a pragmatic path. Information security becomes part of everyday work—transparent, efficient, and future-proof.