SpiceQMS for professional services
Quality and information security in one management system, with evidence ready when customers ask.
The starting point
Quality that customers can check
Working for customers means being able to show how the work gets done. For information technology services, Directive (EU) 2022/2555, known as NIS2, lists managed services and managed security services. The EU Agency for Cybersecurity maps its security requirements to ISO/IEC 27001, among others.
In Austria, the NISG 2026 has transposed NIS2 since 1 October 2026. It counts managed services and managed security services for other companies among the sectors of high criticality. As a rule, large companies in this sector are essential entities, medium-sized ones important entities. Added to these are entities that carry out applied research or experimental development for commercial purposes.
At the same time, specialists in professional and technical services are scarce in the EU. A management system must not need a second full-time position.
SpiceQMS brings quality and information security together in one system. Your customers then see that you can prove what you promise. And your teams work in processes they understand themselves.
ISO 9001 with information security
SpiceQMS includes chapter templates for ISO 9001 and ISO 27001. Both run in parallel in one management system. You document the context of the organisation for each management system, with interested parties, their priority and linked risks. Security risks are a risk class of their own, assessed by impact and likelihood. Each risk assessment is a record of its own with an approval step, and its history stays traceable. You create measures directly from the risk.
- ISO 9001 and ISO 27001 in parallel
- Interested parties linked to risks
- Chapter structures only, not the full text of the standards
Audits
Evidence that is ready
You plan audits internally, at suppliers and at customers, as system, process, product or compliance audits. Auditors come from your own organisation or from outside.
Audit questions sit per chapter, with report items per question. You rate report items on a scale from fulfilled to nonconformity, with colour and points. One step turns a report item into a finding, carrying over the audit and the item.
Findings run from assessment through implementation to the effectiveness check. When customers ask for evidence, audits, findings and measures are ready instead of being compiled first.
Many other services, such as consultancies, engineering offices or agencies, are not a separate sector under the NISG 2026. Covered customers, however, must consider supply chain security, including the cybersecurity practices of their service providers. An ISO 27001 management system in daily use thus also becomes an argument when contracts are awarded or renewed.
Key figures
Key figures for the management review
Key figures are calculated live from the system data, including ratios. They appear as a tile or a gauge, with trends over 30, 90, 180 or 365 days.
Reports across any module are built without programming skills. Output templates list linked data in loops, for example all processes with their risks.
The management review gets its basis at the push of a button. Management talks about decisions, not about the figures themselves.
Processes your team lives
You draw processes in BPMN 2.0 and link them to documents, risks and organisational units. A process can also be a checklist or work instruction. Process steps have predecessors and successors, and the workflow engine controls approvals. User guidance leads through processes in phases, also as a Kanban board. Whoever joins the team finds out how things work here.
- Processes in BPMN 2.0
- Checklists and work instructions
- Process approvals as workflow
What changes
One system for quality and security
One team maintains one system instead of two. Audits for quality and information security draw on the same processes. Every finding stays linked to its audit and the exact report item. If the NISG 2026 covers you, you add its requirements in SpiceQMS as a separate rule set alongside ISO 27001.
Key figures are calculated separately for each company, and the management review and customer meetings rely on the same numbers. On request, you run SpiceQMS in your own data centre.
Tell us which standard you are working towards. Together we look at which processes you map first.
Three products, one platform
What SpiceCRM and SpiceHCM add for professional services
SpiceCRM, SpiceHCM and SpiceQMS run on the same platform. One licence for More opens all three, and anyone working in several is only billed once.
SpiceQMS: proving quality
ISO 9001 and ISO 27001 sit in one management system, with audits and findings.
SpiceCRM: the customer’s view
With SpiceCRM, projects and service tickets run on the same platform. Feedback after service visits and the Net Promoter Score from SpiceCRM show how satisfied customers are.
SpiceHCM: proving competence
With SpiceHCM, audits use the same personnel data. Competences, training and proof of qualifications from SpiceHCM show what ISO 9001 requires on competence and training.
Talk to us.
What are you planning, and what is missing today? We reply personally and tell you plainly whether Spice is the right fit.
- You tell us what you have in mind.
- We get back to you personally by email.
- If you like, we show you Spice in a demonstration.
Prefer to talk directly? office@spicecrm.com+43 (1) 89083610