Imprint and Data Protection

What Imprint and Data Protection does

pureISM (legal entity: pure ISM GmbH) is a Bremen-based, privately held German information security consultancy that targets operators of wind parks, solar parks, and technical operations management (Betriebsführung) firms as critical energy infrastructure. The company helps these clients navigate KRITIS-V (the German critical infrastructure ordinance) and NIS-2 (the EU cybersecurity directive) by combining a self-service digital assessment platform (pure Check, an 8-question KRITIS-V/NIS-2 applicability questionnaire) with a stack of professional services: maturity-level analysis (Reifegradanalyse), full ISMS project support (Projektbegleitung), individual ISMS coaching, certification audit accompaniment, on-demand consulting hours, and Information Security Officer (ISB) placement.

The technology foundation is modest: a web-based questionnaire platform hosted on Vercel with a Neon-hosted PostgreSQL database, all data processing kept in AWS region eu-central-1 (Frankfurt), supported by HubSpot for CRM and sales automation, Microsoft Teams for customer communication, and Stripe for payment processing. The company markets ISO 27001 certified consulting, NIS-2 readiness, and KRITIS-V compliance as its core qualifications, and assembles a multidisciplinary team covering IT and OT technical security, legal/regulatory expertise, risk management, and operational management.

The business model is a hybrid: a freemium digital entry point (free pure Check assessment) feeds a primarily services-led revenue engine of individually contracted consulting hours, multi-year ISMS implementation projects, and recurring ISB staffing. The company explicitly does not contract with consumers, operates exclusively in Germany (DACH), and discloses no external investors or funding. Pricing is opaque and individually negotiated, with 14-day payment terms on invoiced services. Headcount sits in the 11–50 band; the legal representative and Geschäftsführer is Michael-Peter Tenten, registered at Stephanitorsbollwerk 3, 28217 Bremen (HRB 36570, Amtsgericht Bremen).

Name

Imprint and Data Protection

Legal name

pure ISM GmbH

Website

https://pure-ism.de

Company type

Private

Operating status

Operating

Headcount range

11–50 employees

Short description

pureISM is a German information security consultancy that helps wind and solar park operators achieve KRITIS-V and NIS-2 compliance via a self-service assessment platform (pure Check) and professional ISMS consulting, coaching, certification, and Information Security Officer placement services.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting for Critical Infrastructure

NAICS

Testing Laboratories and Services (541380), Computer Systems Design and Related Services (54151)

SIC

Services-Testing Laboratories (8734), Services-Prepackaged Software (7372)

akta.pro industry

PRIMARYEUAMANAJ

Standards, Certification & Compliance (RECs/GOs, sustainability reporting)

Energy, Utilities & Environment/Renewable Energy (Solar, Wind, Hydro & Geothermal)/Policy & Regulatory Consulting for Renewables

Keywords

• Critical infrastructure security
• ISMS consulting services
• Renewable energy cybersecurity
• Regulatory compliance advisory
• KRITIS NIS2 readiness

Headquarters

HQ city

Bremen

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D, Infrastructure

Revenue model

1. Assessment Platform: The platform provides a one-time-use questionnaire to customers. Each purchased questionnaire can be completed once, after which an evaluation is generated and provided to the customer. This represents a per-transaction revenue model for the assessment tool itself.
2. Professional Consulting Services: Customers can book paid consulting hours with company-employed consultants. Consulting services explain platform results and discuss possible action options. Pricing is individually contracted. Revenue recognized after service delivery with 14-day payment terms.
3. Project-Based ISMS Implementation: Full project support for ISMS establishment, including action planning, expert consulting, certification support, and Information Security Officer (ISB) placement services. Revenue determined through individual agreements.

Pricing tiers

Go-to-market motion1 record

Distribution channels2 records

Marketing channels4 records

Core offering

pureISM operates a self-service web-based assessment platform (pure Check) that uses 8 targeted questions to evaluate which KRITIS-V and NIS-2 regulatory requirements apply to a renewable energy operator's business. Each purchased questionnaire is single-use and generates an immediate evaluation report. The platform is complemented by professional consulting services including paid consulting hours, full ISMS project implementation support, maturity analysis, ISMS coaching, and certification accompaniment for operators of wind and solar parks as critical infrastructure in Germany.

Product overview

pureISM offers a SaaS-based information security assessment platform with integrated consulting services, specifically designed for operators of wind and solar parks as critical infrastructure. The core product is the pure Check self-assessment questionnaire (8 questions, one-time use per purchase), which generates instant evaluation reports on KRITIS-V and NIS-2 compliance readiness. This is complemented by professional services including Reifegradanalyse (maturity analysis), ISMS Projektbegleitung (full project support), ISMS Coaching (individual training), and Beratungsstunden (on-demand consulting hours). The company also provides an Information Security Officer (ISB) staffing service. The platform is accessed via the assessment portal at assessments.pure-ism.de, with optional human consulting add-ons.

Differentiator

Problem solved

Functional benefit

Products and services

• pure Check A self-service digital assessment tool featuring 8 targeted questions that instantly evaluates which KRITIS-V and NIS-2 regulatory requirements apply to a renewable energy operator's business. Each purchased questionnaire is single-use and generates an immediate evaluation report on regulatory compliance readiness. The platform is accessed via assessments.pure-ism.de.
• Beratungsstunden (Consulting Hours) Optional paid consulting sessions with pureISM-employed advisors available as an add-on to platform purchases. Sessions explain platform results and discuss possible action options for KRITIS-V and NIS-2 regulatory compliance. Pricing is individually contracted with 14-day payment terms after service delivery.
• ISMS Projektbegleitung (ISMS Project Implementation Support) Full project support service for establishing and implementing an information security management system (ISMS) for renewable energy operators. Includes action planning, expert consultation, best-practice approaches, and certification accompaniment. Sold under multi-year contracts with individually negotiated pricing. Also covers Information Security Officer (ISB) placement services and Zertifizierungsbegleitung (certification process support).

Quantifiable outcome

• 42% average maturity level improvement demonstrated through assessments

Named customers3 records

Segments2 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

Five partnerships are on record, tiered core and supporting.

• Vercel Inc.coreTechnology or IntegrationVercel Inc. (headquartered in USA) provides external hosting for the pureISM web application. Data processing occurs exclusively in AWS region eu-central-1 (Frankfurt am Main, Germany). A Data Processing Agreement (AVV) is in place. This is a critical infrastructure partnership for the company's digital service delivery.
• Neon, Inc.coreTechnology or IntegrationNeon, Inc. (headquartered in USA) provides PostgreSQL database hosting for the assessment platform. All core data (user data, assessment data, etc.) is processed and stored exclusively in AWS region eu-central-1 (Frankfurt am Main, Germany). A Data Processing Agreement (AVV) is in place.
• HubSpot Inc.coreTechnology or IntegrationHubSpot CRM is used for customer relationship management, enabling capture and analysis of customer interactions across email, social media, and phone channels. Data transfer to the USA is based on Standard Contractual Clauses. HubSpot is certified under the EU-US Data Privacy Framework.
• Microsoft Ireland Operations LimitedsupportingTechnology or IntegrationMicrosoft Teams is used for video and audio conferencing with customers. The service enables remote consultation and communication. Microsoft is certified under the EU-US Data Privacy Framework.
• Stripe Payments Europe, Ltd.supportingTechnology or IntegrationStripe processes payment transactions for the platform. Data transfer to the USA is based on Standard Contractual Clauses of the EU Commission. Stripe provides secure payment processing infrastructure.

Scale indicators2 records

Recent moves2 records

Expansion highlights4 records

Direct peers

• DNV: DNV provides cybersecurity, certification, and advisory services specifically to the energy sector, including renewable energy assets. It is the closest large-scale comparable to pureISM in combining critical infrastructure expertise with cyber/ISMS certification work.

Broad incumbents

• SGS: SGS is one of the world's largest TIC companies, providing cybersecurity audits, ISO 27001 certification, and energy sector compliance services. It competes with pureISM in certification work but lacks the exclusive renewable-energy positioning.
• Bureau Veritas: Bureau Veritas is a global TIC company offering certification and risk management services for energy and infrastructure clients. It competes for ISMS and NIS-2 compliance mandates, though its focus is broader and more international than pureISM.
• PwC Germany: PwC Germany offers critical infrastructure protection, NIS-2, and ISMS consulting to energy operators. As a Big 4 incumbent, it represents both a competitor and a potential channel partner for pureISM on smaller accounts.
• KPMG Germany: KPMG's German cybersecurity practice serves utility and energy clients with KRITIS/NIS-2 advisory and ISMS implementation. It is a broad incumbent that could absorb pureISM's niche opportunity through enterprise-wide framework agreements.
• TÜV Rheinland: TÜV Rheinland provides cybersecurity, information security, and operational technology certification services across energy and industrial sectors. It overlaps with pureISM's ISO 27001 and ISMS work but at significantly larger scale and broader scope.
• TÜV SÜD: TÜV SÜD is a major German TIC (Testing, Inspection, Certification) body that offers ISO 27001 certification, KRITIS advisory, and energy infrastructure services. It competes with pureISM in certification accompaniment but serves a much broader portfolio.
• EY (Ernst & Young) Germany: EY's cybersecurity consulting arm provides KRITIS, NIS-2, and ISO 27001 advisory services to German energy and industrial clients. It competes with pureISM on enterprise mandates and brings significantly more delivery capacity.

Emerging players

• Drata: Drata is a compliance automation platform for SOC 2, ISO 27001, and similar frameworks. It is an emerging alternative to workflow-driven compliance consulting and represents a longer-term substitute risk for pureISM's assessment methodology.
• Vanta: Vanta is a compliance automation platform that helps companies achieve and maintain ISO 27001, SOC 2, and other certifications. It represents a software-first competitive threat to pureISM's pure Check tool and could expand into NIS-2 compliance templates.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights5 records

Customer concentration

• LinkedInlinkedin.com/company/pure-ism-gmbh

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Imprint and Data Protection