What happens in the Vorbereitung (preparation) phase of building an ISMS, and why does it come first?

Securing the management mandate: Auftrag durch GL → Auslegeordnung → Vorschlag an GL → Budget-Gutsprache.

The four chronological steps:

1. Auftrag durch GL — an explicit assignment from the Geschäftsleitung (executive management): security starts as a top-down mandate
2. Auslegeordnung — stocktaking/situation analysis: what exists, what's required, where are the gaps?
3. Vorschlag an GL — a concrete proposal back to management: scope, approach, resources
4. Budget-Gutsprache — budget commitment

Why first: an ISMS built bottom-up by enthusiastic IT staff without mandate and budget fails at the first conflict with a business unit. The preparation phase creates the two things every later phase depends on: legitimacy (mandate) and resources (budget). ISO 27001 encodes the same idea in clause 5 — "Leadership and commitment" is a hard requirement, not a nicety.