ISO 27001
Sections
Browse
Related Services
Comply
How secure is your business
ISO 27001 establishes rules and regulations set by the International Organization for Standardization that guide you through the creation of an information security program that allows you to manage information risk effectively.
Compliance with ISO standards gives your organization instant credibility for following strict quality control procedures that optimize performance and make your data safer.
To help your organization decrease implementation timelines and costs during initial certification, our advisory team evaluates your environment and determines short-term project plans from the perspective of experienced implementers and auditors who maintain the necessary credentials to certify an organization as prescribed by relevant accreditation rules.
We are uniquely qualified and experienced to help you build a management system that complies with ISO standards. By wearing both the auditor and implementer “hats,” we reduce the risk that your organization spends too much time over-preparing for a certification audit or is ill-prepared for the initial third-party audit and fails the resulting inspection.
Managed service for ISO compliance
Our certified lead auditors determine your organization’s preparedness to pursue formal certification via an accredited certification body. ISO readiness assessments are performed against the mandatory certification requirements comprising Clauses 4 through 10 of management system standards (MSS). In the case of ISO 27001, we evaluate control objectives prescribed within Annex A against required policy and procedure documentation through an abbreviated design check of the management system.
Why certify your Information Security Management System
Certifying your ISMS against ISO/IEC 27001 can bring the following benefits to your organization:
Independent framework that will take account of all legal and regulatory requirements.
Gives the ability to demonstrate and independently assure the internal controls of a company (corporate governance).
Proves senior management commitment to the security of business information and customer information.
A step by step approach
The pre-assessment includes:
Workshop overview that provides an interpretation of applicable ISO requirements to be documented
Observations and best practices based on your organization’s peers and sector-specific trends
Insights into your management system documentation on processes, internal controls, internal auditing, and management review
Upfront analysis of risks that could threaten your ability to meet the applicable ISO standard requirements
A summary of current business processes and related controls along with remediation recommendations
The pre-assessment serves as a training and awareness session for internal stakeholders and interested parties, who may serve as designated control owners and participate in required annual activities (e.g., risk assessment, internal audit). In addition to reviewing the defined common controls framework objectives, the lead auditor covers:
Workshop overview that provides an interpretation of applicable ISO requirements to be documented
Observations and best practices based on your organization’s peers and sector-specific trends
Insights into your management system documentation on processes, internal controls, internal auditing, and management review
Upfront analysis of risks that could threaten your ability to meet the applicable ISO standard requirements
A summary of current business processes and related controls along with remediation recommendations
Meeting with your governance, risk, and compliance team to determine core documents
We meet with your governance, risk, and compliance team to determine management system core documents. As required by ISO standards, we draft the work products in response to the mandatory security governance requirements and your readiness pre-assessment.
Controls policy and procedure development
We augment your organization’s internal process owners to establish appropriate policies that meet control objectives justified for inclusion to your management system, as appropriate.
Management system risk assessment
During the periodic risk assessment following the management framework prescribed within ISO 31000:2018, we:
Quantitatively score inherent and residual risks based on your risk tolerance scheme.
Determine risk severity ratings and risk treatment options.
Develop short-term risk treatment plans for residual risks outside your organization’s risk acceptance tolerance based on established criteria.
Determine each business function’s requirements for the confidentiality, integrity, and availability of information and the overall sensitivity of data supporting these processes.
Management system internal audit
We execute an independent, periodic internal audit against management system requirements of the in-scope MSS, and controls justified for inclusion per the statement of applicability. As part of the required documentation inspection, we determine sufficiency of sampled control procedures provided by your organization.
Deliverables include:
A three-year management system internal audit plan
Annual management system internal audit report
Lead auditor competency profile or evidence of relevant lead auditor certification
Management Review
After the completion of the risk assessment and internal audit inputs, we facilitate the resulting review of the management system with senior and operations management personnel who are key internal interested parties to the program’s establishment. We develop a recurring supporting agenda presentation template that meets the ongoing requirements for this periodic management review activity.
We are with you every step of the way
External audit support
We help your organization identify and select an accredited certification body registrar that will assess your organization against in-scope certification requirements. During the initial certification audit, we respond and defend inquiries related to its advisory work products made by the appointed lead auditor in interviews and walkthroughs on behalf of your organization. For any identified findings or non-conformities, we assist with the root cause analysis (RCA) and the development of corrective action plans resulting from the external certification audit.
