Learn how Stadtwerke Bonn uses CRISAM® GRC to connect ISMS and BCM on one central platform and make risks transparent.
Essen, September 2026: At the second IT Security Day for network partners in Essen, CRISAM® and Stadtwerke Bonn, the municipal utility of the city of Bonn, showed how connected information security and risk management can be built on a shared data foundation. The customer reference story traced the path from modeling through business impact and risk analysis to prioritizing specific measures.
When Regulation Meets Established Structures
On September 22, 2026, experts gathered at the second IT Security Day for network partners in Essen to discuss current requirements for information security, governance, and regulation. Together with Stadtwerke Bonn, CRISAM® showed how governance, risk, and compliance can be combined with information security and business continuity on a single platform. Tim-Benjamin Bohmfalk presented the platform, and Rita Bohlmann shared insights into its practical implementation.
Today, companies have to meet numerous requirements at the same time, from IDW PS 340 n.F. and NIS2 to the EU AI Act, ISO standards, and growing documentation obligations. At the same time, these requirements often run into Excel lists, email chains, and siloed solutions that do a poor job of connecting data, responsibilities, and evidence.
This creates significant coordination effort, especially ahead of audits and management meetings. Information has to be consolidated manually, evidence is scattered, and status reports take a lot of work to prepare. That makes it harder to maintain a consistent view of risk and slows down decisions.
One Shared Data Foundation for ISMS and BCM
That is why CRISAM® GRC takes an integrated platform approach. Risk management, internal control system, audit management, ISMS and BCMS, data protection, ESG and CSRD, compliance, and tax compliance all use the same data foundation. Companies can start with one module and add further disciplines without having to introduce another separate system with its own data storage.
Configurable workflows map responsibilities and multi-level approvals. Deadlines, reminders, and escalations are managed within the process. Every change remains traceable through versioning and an audit trail. Dashboards, digital approvals, and exports to Office or PDF support reporting to management, the executive board, and supervisory authorities.
How Stadtwerke Bonn Uses CRISAM®
Stadtwerke Bonn employs around 2,800 people. Its responsibilities range from energy and water supply to waste recovery, mobility, and public transportation. This diversity makes the dependencies between critical services, IT processes, basic services, and infrastructure particularly relevant. In Essen, Rita Bohlmann explained how CRISAM® maps these relationships in a structured way for further analysis.
Modeling Makes Dependencies Visible
Implementation starts with modeling. Organizational units, services, processes, systems, and technical resources are captured in a shared structure. This creates a clear picture of dependencies. Before risks are assessed, it becomes clear which IT and infrastructure assets support a critical service and where outages could affect several areas.
The approach combines a top-down and a bottom-up view. At the level of critical services, protection requirements and potential impacts are considered. At the level of basic services and infrastructure, the likelihood of occurrence is assessed. This link creates a solid foundation for the subsequent business impact analysis and risk analysis.
From Business Impact Analysis to Risk Assessment
In the business impact analysis, Stadtwerke Bonn determines the potential damage. The risk analysis adds the likelihood of occurrence to this perspective. Both assessments feed into the calculation of the overall risk. Because the underlying assets and relationships have already been modeled, the assessment, its cause, and the affected service remain connected.
Measures are derived from the analysis. They can be assigned to control objectives, combined, and prioritized. This shows which measure should be implemented first and which risks it addresses. As a possible extension, the presentation showed a Monte Carlo simulation whose results can be passed on to enterprise risk management.
Traceability and Technical Integration
For regulated organizations, technical operability matters as much as methodology. According to the presentation, CRISAM® holds a multi-site ISO 27001 certification and a TISAX Assessment Level 3 label, and supports GDPR-compliant processing. The platform can be operated as a SaaS solution or on-premises. Single sign-on via Microsoft Entra ID or Active Directory and an open REST API make it easier to integrate into existing IT landscapes.
Regulatory Requirements Call for Connected Management
Cornelis Hilscher of Germany’s Federal Network Agency (Bundesnetzagentur) provided further expert input. His talk on IT and cybersecurity regulation put current developments into context and offered an outlook on upcoming requirements. One thing became clear: The more regulatory obligations have to be met in parallel, the more important consistent processes, clear responsibilities, and auditable evidence become.
The Stadtwerke Bonn presentation made this connection tangible in practice. There, CRISAM® serves as a shared foundation for modeling structures and dependencies, assessing business impacts and risks, and prioritizing measures in a traceable way. The result is a consistent view that connects day-to-day operational work, information security, and management reporting.
Organizations that still manage GRC, ISMS, or BCM in separate tools should therefore pay particular attention to the shared data foundation. It determines whether information has to be maintained multiple times or can be reused across disciplines. CRISAM® supports this integrated approach with a modular design and can be expanded to cover additional requirements.
Rethink Your GRC Landscape as an Integrated Whole
Would you like to find out how your existing GRC and ISMS landscape can be brought together on one central platform? In a personal CRISAM® live demo, we’ll show you how processes, risks, controls, and evidence can be mapped in an integrated way and how existing structures can be developed further.
Schedule a personal CRISAM® live demo and discuss your specific situation, requirements, and next steps with our team.
Would you like to get to know us?
Discover Our CRISAM® / AWADO
On-Site Training
The CRISAM® / AWADO on-site training at the GenoHotel Baunatal offers hands-on expertise in building and running an ISMS or IRM, taught by experienced practitioners. Seats are limited, so reserve yours now and strengthen your risk management.
