Starter — Prepare

Build a defensible baseline before you build anything else

Starter answers one question properly: where do you actually stand? A control-level self-assessment with baseline and advanced criteria per theme, alongside the four foundations an ISMS needs before anything else — approved policies with owners, a written scope, a classification scheme, and awareness training with an acknowledgment record.

Who this is for

Smaller suppliers beginning preparation for the first time
Teams with security practices in place but nothing documented
Organisations that need a policy baseline approved before a wider programme is funded
Anyone who wants to understand the shape of the work before committing to it

Starter

Prepare

$49one-time

Assess where you stand in detail, and put the ISMS foundations in place.

Detailed readiness self-assessment workbook
Core information security policy set
ISMS scope document
Classification and handling guide
Information security awareness training pack

What is included

Best for: Smaller suppliers starting preparation, or teams that need a defensible document baseline before anything else.

One-time purchase — not a subscription. Your purchase includes the toolkit as it exists at the time of purchase. Future major editions are not automatically included.

What changes

The outcomes this tier is built for

Deliberately phrased as outcomes rather than document counts. A folder of files is not a result.

A policy set someone owns

Each policy has a named owner, an approval and a review date. That alone resolves the most common finding in a first review.

A written scope

Sites, entities, systems and information types. Without this, nothing downstream can be bounded or finished.

An honest readiness picture

A control-level self-assessment with baseline and advanced criteria per theme, so the answer is a position rather than an impression.

A classification scheme people can apply

Levels, labelling, and handling rules for storage, transfer and destruction — the decision every other control depends on.

Awareness training with a record

A deck covering classification, passwords, incidents and social engineering, with an acknowledgment sheet that produces the attendance record.

A defensible starting position

Enough structure that a customer question about your security posture has a documented answer.

What is included

Core Policies
Information security policy set with ownership and review cadence.
ISMS Scope Document
Scope statement covering sites, entities, systems and information types.
Classification & Handling Guide
Classification levels with storage, transfer and destruction rules.
Awareness Training
Employee awareness deck with an acknowledgment sheet.
Readiness Self-Assessment
Detailed control-level self-assessment with baseline and advanced criteria per theme.

What is not included

Stated plainly, because finding out after purchase is a bad experience.

Gap Analysis Workbook
Risk Management
Supplier Assessment
Management Review Template
ISO/IEC 27001 Alignment Layer
Prototype Protection Readiness
Data Protection Readiness
Multi-Site Governance
CAPA Tracker
KPI / KRI Dashboard
Third-Party Portfolio
Training Matrix
Executive Reporting

Consulting, review of your documents, or assessment support
Any guarantee of an assessment result, label or certification

Need what is missing above?

Professional adds it. Best fit for teams actively preparing for a TISAX assessment or customer information-security review.

Compare Professional →

Questions about this tier

Is Starter enough to prepare for an assessment?

For most organisations, no — and we would rather say so. Starter gives you the baseline. Preparation also requires risk treatment, supplier assessment and management review, and the action plan and dashboard that turn assessment results into managed work — which is what Professional adds. If you already have an assessment date, start with Professional.

We have some policies already. Is this still useful?

Usually yes, for two reasons: the ownership and review structure is what is normally missing rather than the policy text, and the self-assessment tells you where those policies are actually applied regardless of who wrote them.

Can we upgrade later?

Yes. The tiers are cumulative in structure — Professional contains the Starter foundation, so nothing you do at this level is discarded.

ISAREADY provides independent assessment-readiness resources and practical information security tools. ISAREADY is not affiliated with, endorsed by, or acting on behalf of ENX Association, VDA, ISO or any TISAX audit provider. Use of ISAREADY resources does not guarantee a TISAX assessment result, TISAX label, ISO certification or regulatory compliance.

Not sure this is the right tier?

The free self-assessment ends with a recommendation based on your readiness indicator and organisation profile — including the reasoning, so you can disagree with it.

Start the Free Readiness Assessment Compare all tiers