ISO 27001 Audits and Advisory

Achieving ISO 27001 certification and keeping it for three years running

THE CHALLENGE

A B2B technology company handling sensitive customer data needed ISO 27001 certification to meet customer and contract requirements. It had security practices in place, but they weren't documented, measured or managed as one system. The company needed to build a certifiable information security management system (ISMS), pass the certification audit and keep the system running well enough to pass every year after.

WHAT WE DID

Ran a gap assessment against ISO 27001 requirements and defined the scope of the ISMS

Led risk assessment and treatment, and built the Statement of Applicability

Wrote and rolled out the core policies and procedures, including access control, incident management, supplier security, business continuity and change management

Aligned IT service management processes (incident, problem and change) with ISO 27001 controls, so security was built into daily operations rather than kept on paper

Trained staff on their security responsibilities

Ran internal audits and management reviews ahead of each external audit

Supported the team through the certification audit and each surveillance audit that followed

RESULT

Passed the initial certification audit [with no major non-conformities]

Passed two further annual surveillance audits, so certification was maintained through the full three-year cycle

Certification that customers could rely on, which [helped win / retain contracts with enterprise clients]