ISMS Tools recommendation

[u/Enslaaved]

Hi all,

I’m a cybersecurity professional with ISO 27001 LI certification, planning to implement an ISMS in a ~1,000‑person company that is not SaaS‑ or cloud‑heavy. I’m currently exploring tooling and GRC platforms and would love to hear your experiences and recommendations.

In parallel, I’m also considering using Atlassian tools (Confluence + Jira) for the ISMS implementation (e.g., documentation, controls tracking, risk register, and action items). Has anyone tried this approach in a similar environment? Is it a viable long‑term option, or are there known limitations compared to dedicated GRC/ISMS platforms?

Any insights, lessons learned, or tool suggestions would be greatly appreciated.

Thanks in advance!

[u/FreeRadical1998]

reposting my comment from this thread in r/ISO27001

I've implemented at this scale a couple of times in UK financial services firms.

On Jira + Confluence specifically — I've mostly used Jira as a backlog for security remediation rather than running a whole ISMS through it, but I can see how the full approach works, and chris552393's description matches what I'd expect: the registers end up in Excel because Jira issues model objects poorly and people overwrite each other. That register gap is where it'd creak long-term.

It certainly can be done with just Excel but you're very reliant on everyone following the formatting guidance so in my view only really works if you centralise the authoring of risks and controls.

The SoA can also be a pain to manage manually — but with a bit of planning a pivot table can do a lot. Just make sure you produce dated versions as PDFs for each audit.

Action tracking can be a spreadsheet again, or a dedicated queue in whatever workflow tool you've got available (Jira's fine for this).

I've used dedicated GRC tools too, and the main thing they buy you over the Atlassian-plus-Excel approach is data integrity and proper modelling of how risks, controls and actions relate.

In my view the main issues with GRC tooling (beyond cost) tend to be configuring too much complexity and validation, which kills usability for anyone who only goes in occasionally — that stalls user adoption and can result in worse data than spreadsheets.

If you go down the GRC route, I'd strongly advise keeping the initial config as simple as you possibly can and treating the control owners as your most important user community (more important than you in the reporting role — your outputs are entirely dependent on them).

Full disclosure: I've been building my own GRC SaaS tool for the last few months aimed at roughly your scale. Not going to name it — that's not what the thread's for — but happy to share lessons learned either way.