ISO 27001

ISO 27001 involves identifying project stakeholders and key contacts, developing and defining a communication plan, establishing program priorities, and determining the system scope and applicability, all while establishing and defining the criteria for success.

The process entails conducting discovery interviews to gather organizational specifics and documentation, reviewing all available information to identify security and privacy compliance gaps, assessing overall maturity, and ultimately delivering a formal internal audit report. The report includes identified findings, associated risks, impact on compliance requirements, as well as detailed recommendations and remediation steps.

Findings and gaps are assessed based on severity. Then, a project plan is formalized with prioritization of the most critical tasks, along with the identification of specific owners and proposed timelines for remediation.

Implementation includes revising existing information security policies and procedures, developing additional information security management system policies, establishing a formal risk management program with a deliverable risk assessment, and actively participating in communications with external auditors, offering guidance throughout the formal ISO 27001 audit process.

The objective is to resolve any nonconformities identified during the audit and attain certification while ensuring meticulous planning and adherence to all recurring requirements for Year 2 and Year 3. Additionally, we work collaboratively with staff to maintain continuous guidance, direction, and support throughout each surveillance audit in the above mentioned capacities.