ISO27001 CERTIFICATION

Step 1: Staff training workshop

We start by making sure that your company understands how ISO27001 works, what Information Security Management System is and how to benefit from it.

We explain critical steps of implementation and operation of ISO27001 to you in under 5 minutes. After that, we equip you with necessary, key competencies to operate the Information Security Management System (ISMS).

We address workshop to top-level management and decision-maker process owners. ISO27001 is a straightforward standard which can bring a lot of benefits to you – we will make it crystal clear.

We help you to understand the following:

• What do you have already – which of the current activities can be used to operate ISMS.
• What your objectives are for implementation of ISO27001 – how can your organisation maximise its benefits.
• Which processes are critical to meet business objectives.
• What important information your organisation is storing and depends upon.
• What risks do you face? We will help you to understand the specifics of your industry based on real-life examples.
• Can we integrate ISO27001 with other management systems like ISO9001, ISO20000, PCI DSS?

Step 2: Security Review of the organisation - ISO27001 Gap Analysis

Information Security Review has two parts:

1. General Information Security Review – a best practice-based audit aimed at the identification of improvement objectives
2. ISO27001 Gap Analysis – specific review of the compliance with section 4 to 10 of ISO27001

You receive specific recommendations and a roadmap. The roadmap is custom made to you in accordance with your industry, your organisational size, capacity, and business strategy objectives.

In addition, you will receive a report which may be used as your project improvement plan.

Step 3: Foundation

In the foundation step, we help you to begin implementing ISMS. We will guide and assist you in the following activities:

• Building asset management and corresponding asset management policies and processes
• Identify legal, statutory and contractual obligations which apply to your organisation – we may be working with your legal team or our legal advisors would assist you
• Create a list of management objectives and evaluation criteria. In addition we will provide you with set KPI’s
• Definition of tasks and responsibilities
• Identification and creation of initial policies and procedures.

Step 4: Risk Management

Risk Management is an essential part of ISO27001 – it ensures that organisational objectives are achieved. Our experts will assist you in creating the following:

• Based on ISO27001 and ISO27005 create a risk management methodology which is the most suitable for your organisation
• Implementation of the Risk Assessment process
• Evaluation of risks
• Selection of appropriate risk response action

At the end of this stage, your organisation will be armed with tools to become self-aware about potential cyber security issues. Your organisation will be able to implement relevant responses to risks and threats.

This phase will take care of unwanted surprises.

Step 5: Continual improvement - Internal Assessment

Your company has identified objectives and legal requirements. You know what assets you have and you can manage them efficiently. You have identified risks and identified relevant actions to address them. However, the cyber security world is changing constantly. Your business is evolving, your objectives will change. Your ISMS has to improve to stay ahead of threats. Your ISMS has to respond to changing business objectives. We will assist you to implement the following processes:

• Identification and management of improvement opportunities
• Identification areas to be reviewed
• Assistance with 3rd party assessments and reviews including certification assessments
• Assessment and review plan
• Identification of new priorities and objectives