SpiceQMS for telecommunications
Information security and quality side by side in one management system.
The starting point
Networks are infrastructure, and so is their security
Directive (EU) 2022/2555, known as NIS2, lists providers of public electronic communications networks and services as digital infrastructure. An outage then affects not only customers but whole regions. Under the Austrian NISG 2026, risk-management measures take account of relevant standards where applicable. A management system to ISO 27001 helps you demonstrate them.
Many companies in the EU find specialists in information and communication technology hard to recruit. Whoever is short of specialists cannot afford to maintain two management systems. And whoever runs a network has little time for paperwork.
SpiceQMS supports you in running both in a single system. Security then becomes demonstrable, for external audits and for the authority alike.
Two standards, one management system
SpiceQMS holds chapter templates for ISO 27001 and ISO 9001, active in parallel in one management system. Security risks are a risk class of their own, rated by impact and likelihood. Risk assessments are records of their own, with an approval step. That keeps the history of every assessment traceable. Interested parties are recorded with priority and linked to risks. One audit checks both standards on the same process.
- Security risk as its own class
- Assessments with approval
- Chapter structures only, not the full text of the standards
Risks
Every risk through to its action
A risk runs from new through assessment and planning to closed. Actions are created as tasks on the risk, already linked. Changes to risks are tracked. Assessments carry a date and a calculated risk value. Opportunities are a module of their own.
The dashboard for risks and compliance shows the risk analysis as a chart. Risks are included in the global full-text search.
The board sees where the network is most exposed. And the next action is already assigned to someone. Inspections by the authority become predictable.
Audits
Audits that satisfy the authority too
System, process, product and compliance audits run in the same system. A finding takes over audit, item, type and status automatically. Findings run through to the effectiveness check and closure.
Each finding stays linked to the exact report item. Auditors come from your own staff or from an external body. Report items are rated on a colour scale with points.
When the authority asks, the trail from finding to action is complete. No evidence has to be handed in later.
Supply chain with evidence
Networks depend on suppliers of technology, software and services. Their security is therefore also a question of the supply chain. In SpiceQMS, audits also run at suppliers, in the same system as internal audits. Supplier evaluations have a module of their own. The dashboard can evaluate supplier ratings as a key figure. When the authority asks about the supply chain, audits and evaluations are already in place.
- Audits at suppliers
- A module of its own for supplier evaluations
- Supplier evaluation as a key figure on the dashboard
- Findings through to the effectiveness check
What changes
One system, two standards, one team
Information security and quality share documents, processes and audits. Management sees security and quality in one report. Key figures are calculated live, separately for each company. Documents run with revisions and their own approval. The quality dashboard shows the process map. You choose the operation yourselves, in the Spice cloud or in your own data centre.
The NISG 2026 has applied since 1 October 2026. It covers providers of public communications networks and publicly available communications services regardless of their size. Medium-sized enterprises of this kind count as essential entities. The act requires appropriate and proportionate risk-management measures for the network and information systems you use for operations or services. The minimum content expressly includes supply chain security.
Entities must register with the cybersecurity authority within three months of entry into force or of becoming covered. Within twelve months of the registration obligation arising, a self-declaration must be submitted, including on the supply chain. On request, implementation must be demonstrated through an audit by an independent body. Essential entities must demonstrate operational and organisational implementation within two months of a request. With SpiceQMS, risk analysis, audits and actions for this are already in one system.
Tell us which audits are coming up for you. Together we plan the first management system with both standards.
Three products, one platform
What SpiceCRM and SpiceHCM add for telecommunications companies
SpiceCRM, SpiceHCM and SpiceQMS run on the same platform. One licence for More opens all three, and anyone working in several is only billed once.
SpiceQMS: security you can demonstrate
Risks, audits and actions run in one management system for ISO 27001 and ISO 9001.
SpiceCRM: every contract in one place
With SpiceCRM, contracts and service run on the same platform. In SpiceCRM, service tickets land in the right queue and at the right support level.
SpiceHCM: specialists with evidence
With SpiceHCM, you keep your technicians’ qualifications with validity dates. Training evidence comes from SpiceHCM, from the same data that audits use.
Talk to us.
What are you planning, and what is missing today? We reply personally and tell you plainly whether Spice is the right fit.
- You tell us what you have in mind.
- We get back to you personally by email.
- If you like, we show you Spice in a demonstration.
Prefer to talk directly? office@spicecrm.com+43 (1) 89083610