Cybersecurity
ISO 27001 readiness
ISO/IEC 27001 asks you to run security as a managed system: assess risks, choose controls, check they work and keep improving. We help you set up that system and prepare for certification by an accredited body.
The problem this service solves
ISO 27001 is a management-system standard. A set of firewalls and policies does not make a management system. The standard expects documented scope, a risk assessment method, a risk treatment plan, management review, internal audits and corrective actions, recorded and repeated.
We help you build a system sized for your organization. A twenty-person company should not produce the documentation of a bank. We focus on what auditors need to see and what is useful in practice.
What is in scope
-
ISMS scope and context
Interested parties, scope boundaries and leadership commitment.
-
Risk assessment and treatment
A method that fits you, a risk register and a treatment plan.
-
Statement of Applicability
Select controls from Annex A and justify inclusions and exclusions.
-
Control implementation
Technical controls for access, cryptography, logging, supplier management, secure development and more.
-
Documentation
Policies and procedures the standard requires, kept short.
-
Awareness and competence
Training records and role definitions.
-
Internal audit and management review
Prepare internal auditors, run the first cycle and conduct a management review.
-
Certification audit support
Support through stage 1 and stage 2 audits with the accredited certification body you select.
How the work runs
Establish
Set up the ISMS.
-
1
Scope and governance
Define scope, roles and management commitment.
-
2
Risk assessment
Identify and evaluate risks.
Implement
Build controls.
-
3
Treatment and SoA
Choose controls and implement them.
-
4
Documentation and training
Write what is required and train staff.
Verify
Prove it works.
-
5
Internal audit
Check against the standard.
-
6
Management review
Review performance and improvement actions.
-
7
Certification audit
Support stage 1 and stage 2.
What you receive
- Scope statement
- Risk methodology, register and treatment plan
- Statement of Applicability
- Required policies and procedures
- Internal audit report
- Management review record
- Certification audit preparation
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Management sponsor
- A defined scope
- Time from system and process owners
What this service is not
- Certification itself
- A purchased template set with no implementation
What changes afterwards
- A working ISMS, not only documents
- Controls that match risks
- A better chance of a smooth certification audit
Questions people ask
How long does preparation take?
It depends on size, scope and starting point. Small organizations with solid practices may take months. We estimate after a gap assessment.
What changed in 2022?
ISO/IEC 27001:2022 updated Annex A to align with ISO/IEC 27002:2022, reorganizing controls into four themes (organizational, people, physical, technological) and adding new controls such as threat intelligence, cloud services security and data masking.
Related
-
SOC 2 readiness
Prepare for a SOC 2 examination: scope, control design, evidence collection, gap remediation and a mock walkthrough.
-
Third-party risk assessments
Evaluate vendors and partners by what they can reach in your environment, not only by questionnaire answers.
-
NIST CSF 2.0 assessment
Assess current and target maturity across the six functions of NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response