Service
ISO/IEC 27001 Information Security Management System
Information security is not only an IT matter: access decisions, supplier relationships and everyday habits belong to the same system. This work starts by establishing what the organization actually protects, that is its information assets. Risks are assessed against that inventory, Annex A controls are selected with their reasoning recorded, and the Statement of Applicability is prepared as a document that holds up in an audit.
Who is it for?
Organizations that want to protect their information assets, manage information security risks systematically, meet customer and regulatory requirements or prepare for ISO/IEC 27001 certification.
Scope of work
- Current state and gap analysis
- Identifying information assets and information security risks
- Establishing the risk assessment and risk treatment methodology
- Evaluating Annex A controls and preparing the Statement of Applicability (SoA)
- Structuring information security policies, procedures and processes
- Developing incident management, access control and business continuity processes
- Internal audit and management review readiness
Expected outputs
- An information security management system structure suited to the organization
- An information asset inventory and risk assessment records
- A risk treatment plan and Statement of Applicability (SoA)
- Information security policies, procedures and follow-up tools
Implementation and development plan
On-site, live online or hybrid delivery.