ISO 27001 consultancy

Scope

The scope defines the information, systems and business operations that will be managed under the organisation’s Information Security Management System (ISMS) and will be certified to ISO 27001.

Defining the scope encourages focus on the most critical areas of your business and the risks faced, as well as informing the selection of appropriate controls to tackle these risks.

Our consultants can advise on the most appropriate scope for your organisation, which may significantly reduce the scale of your ISMS implementation and the overall cost.

Gap Analysis – ISO 27001

Gap analysis involves comparing what you are currently doing against what you must do to meet the compliance requirements of ISO 27001.

It highlights shortfalls in compliance and where efforts must be concentrated to meet the requirements of the standard.

Our expertise allows us to accurately assess your organisation’s current levels of compliance and provide pragmatic recommendations.

Additionally, our consultants can perform a gap analysis more efficiently and effectively than internal staff, who are likely to hold other responsibilities and may not be as familiar with the intricacies of the standard.

Risk Management

Risk management is at the core of ISO 27001, so this phase identifies your important information and information processing assets, the assessment of security risks related to these assets, and the mechanisms through which these risks are controlled and monitored.

Our ISO 27001 consultants are recognised as risk management experts, allowing them to build risk management processes that both fit your organisation and meet the requirements of ISO 27001. Working in partnership with you, the team will combine their knowledge of effective risk assessment with your understanding of business operations to accurately assess organisational security risks.

Statement of Applicability (SoA)

The SoA is a fundamental part of your ISMS and is one of the mandatory documents required to achieve certification. It explains which of the information security controls have been selected to tackle risk as well as which have been omitted and the reasoning.

Our team’s expertise and experience of ISMS implementation, coupled with your familiarity of the business, helps to ensure that your SoA meets appropriate standards to achieve certification.

In the implementation phase, we’ll be working with you to put control measures in place to ensure compliance with ISO 27001.

Failure to implement the necessary controls means the organisation will not be compliant with ISO 27001 and this increases the likelihood of breaches and subsequent fines or penalties, as well as reputational damage.

With our support, your organisation can be assured that the control measures implemented are pragmatic and provide the appropriate levels of assurance. As an example, our team can apply their expertise to develop best practice, compliant policies and procedures, allowing your workforce to focus efforts on other implementation activities.

Our wider team can also perform penetration tests and vulnerability assessments to identify vulnerabilities, which can also demonstrate ongoing review and continuous improvement of the ISMS, which is required by the standard.

Engaging with us allows an independent and unbiased view of the suitability of the controls being implemented.

Internal audit

An internal audit involves our ISO 27001 experts reviewing any implemented controls to ensure they are effective and meet the requirements of ISO 27001. Performing audits is a key aspect of ISO 27001 compliance and supports the principle of review and continuous improvement of security that is pivotal to compliance with the standard

As qualified ISO 27001 Lead Auditors, you can be assured that our consultants will perform thorough and professional audits that cover all aspects required to maintain certification.

Certification and readiness (review and audit support)
 

A guiding hand through your certification audits. Our consultants will ensure all required documentation is up to date and in place for the Stage 1 audit and they can help you demonstrate the full operation of your ISMS for the Stage 2 audit.

Using our consultants’ knowledge of the ISO 27001 standard and the expectations of external auditors, gives you the best chance of achieving certification.

Continuous improvement is about maintaining your compliance. This is done by regularly reviewing the performance of the ISMS and enhancing measures where required.

After achieving certification, organisations are subject to regular surveillance audits from their external auditor, approximately every 6‐12 months, to monitor your ongoing commitment to security and compliance.

Organisations must demonstrate that they have reviewed and, where necessary, improved security measures. Any business changes that impact security must be factored into the ISMS to ensure security measures remain robust.

Our expertise and experience can help you devise an effective continuous improvement programme that is suitable for your organisation.