Information Security Management
A comprehensive framework to manage and protect sensitive information, data, and assets, built to satisfy ISO 27001 requirements.
Six phases to ISO 27001.
Gap Analysis
Identify project scope and objectives, and designate the team responsible for the ISMS rollout.
Risk Management
Build a risk framework and assess information systems, assets, and processes for vulnerabilities and threats.
ISMS Requirements
Develop the core ISO 27001 documentation required for an effective management system.
Policies & Procedures
Establish organizational policies and procedures ensuring compliance and safeguarding sensitive information.
Internal Audit
Conduct internal reviews to verify the system functions correctly and adheres to ISO 27001 requirements.
Certification Support
Support the external audit, provide on-site assistance, and resolve identified non-conformities.
What you receive.
Where this connects.
Compliance
Where the ISMS has to answer to a specific regulator: PCI-DSS, SAMA, CBJ, or NCA.
Business Continuity Management
The ISO 22301 counterpart, run through the same gap-analysis-to-certification path.
Third Party Risk Management
Extends the ISMS to the vendors holding your data and running your processes.
Common questions.
Does this lead to ISO 27001 certification?
Yes. The final phase supports the external audit, provides on-site assistance, and resolves identified non-conformities, with the ISO 27001 certificate as the end deliverable.
What happens at the start of the engagement?
A gap analysis identifies project scope and objectives and designates the team responsible for the ISMS rollout, delivered as a gap analysis report.
How is risk handled?
A risk framework is built, then information systems, assets, and processes are assessed for vulnerabilities and threats. That phase produces a risk methodology, an asset inventory and valuation, a risk assessment, and a risk treatment plan.
Do you audit us before the certification body does?
Yes. An internal audit phase verifies the system functions correctly and adheres to ISO 27001 requirements, producing audit reports and corrective action plans ahead of the external audit.