Organising information security in one place
Sardona is the Swiss ISMS platform for companies that want to manage and develop their information security systematically. It links organisational requirements with risks, concrete measures and information on the technical security situation.
This creates a shared working basis for responsible staff, employees and external partners.
Risks and open tasks at a glance
The dashboard brings together risk status and required action. This view shows a demo tenant with sample data.
A typical workflow
A security review reveals a need for action. You record the finding, assess the associated risk and define a measure with an owner and a deadline. You then document the work and the associated evidence. This keeps the link between the starting point, the decision and the implementation traceable.
ISMS and governance
Defining how information security is managed
Manage policies, documents and responsibilities centrally. Versioning and approvals make it clear which requirements apply and how they have changed.
Capture business processes, technical assets and suppliers as the basis for your security work. This information can be used in other areas of the platform, for example in risk assessment or emergency planning.
Risk management
From identified risk to implemented measure
Capture and assess risks in a shared risk register, taking into account affected assets, business processes and dependencies.
Decide how to treat a risk and link it to suitable measures. Owners, deadlines and status information help you track implementation. Also record which risks remain after treatment or are consciously accepted.
Compliance and reporting
Handling requirements traceably
Map controls and evidence to the frameworks relevant to your company. Shared controls can be mapped to several requirements.
Document the implementation status and make open items visible. Overviews and reports help you inform executive management and prepare for customer enquiries and audits.
Technical security situation
Identifying and tracking technical action items
Look at vulnerabilities in the context of the affected assets. Record findings, prioritise their handling and track the associated measures.
Reviewing the external attack surface with External Attack Surface Management (EASM), information on known vulnerabilities (CVE) and current threat intelligence complement your view of the security situation.
With the corresponding integrations, results of technical security reviews can also be included.
Supplier management
Including the security of your service providers
With Third-Party Risk Management (TPRM), you assess suppliers and their significance for your information security.
Collect information and evidence via a supplier portal and document your assessment. Any resulting risks and measures can be taken into account in your further security work.
For providers with AI features, additional questions on the use of AI and the handling of data are available.
Business continuity management
Preparing key business processes for disruptions
Record which business processes are critical, what they depend on and how quickly they need to be restored. Document recovery strategies and responsibilities in a crisis.
With interactive tabletop exercises, i.e. scenario-based crisis exercises, you can test your joint approach. Record the lessons learned and use them to improve your preparedness.
Actual crisis incidents can also be documented and handled through to recovery.
Data protection management
Documenting how personal data is handled
Keep a record of your processing activities. Record which personal data is processed for what purpose, who receives it and how long it is retained.
Handle requests from data subjects and document data breaches with their assessment and the measures taken.
AI governance
Steering the use of AI in your company
Assess AI applications and the associated risks. Link usage rules with the assessment of providers and the necessary safeguards.
With suitable integrations, you can include information on AI applications in use, permissions and possible data leakage. This allows you to compare your organisational requirements with information from actual use.
For developing rules and approval processes, you can add separate consulting from Burri Consulting if needed.
Consulting on AI governance →AI support in Sardona
Sardona uses AI to support you with specific tasks:
- ISMS Copilot: Handle questions about your company’s ISMS knowledge base.
- Risk suggestions: Identify possible risks based on existing information.
- Crisis exercises: Prepare scenarios and have AI take on selected roles during an exercise.
You review the results and decide how to use them.
Optional integrations
Connect Sardona with existing systems if required. Integrations with Microsoft 365, Intune, Defender and Purview can, for example, provide asset data, results of security reviews and information on permissions.
The available features depend on the integrations set up, the permissions and the respective licensing.
Use cases
The features can be used by different types of organisation. The following pages show typical tasks and priorities.
Swiss application and AI infrastructure
Sardona’s application and portal servers are operated in Switzerland. Regional deployments in Switzerland are set up for the AI functions.
Security and data protection →Use the platform, add support as needed
Sardona is developed and operated by Burri Consulting. You can use the platform with your own responsible staff or existing partners. Consulting, implementation support and CISO as a Service can be agreed separately if required.
Consulting and implementation support →Get to know Sardona
In a demo, we use your tasks to show you how the features work together.
Request a demo