ISO 27001 ISMS Consulting Service

ISO 27001 ISMS IMPLEMENTATION AND MANAGEMENT CONSULTING

For ISO 27001 certification, build a working ISMS, not just a document set.

Secure Fors manages the ISMS implementation your organization needs for ISO/IEC 27001:2022 certification. We run scope definition, gap analysis, asset inventory, risk assessment, risk treatment plan, SoA, policies and procedures, Annex A controls, training, internal audit, management review and certification audit readiness in one work plan.

View Roadmap Request an Initial Assessment

ISO/IEC 27001:2022 ISMS / ISMS Risk Treatment Plan SoA Internal Audit and Management Review

ISMS Implementation View

EXAMPLE

Scope and Assets Business processes, information assets, boundaries, parties

PLAN

Risk and Control Risk analysis, risk treatment, Annex A, SoA

Internal Audit and Management Review Performance, nonconformity, corrective action

CONTROL

Certification Readiness Stage 1, Stage 2, evidence, closure tracking

IMPROVE

93 Annex A control

PDCA continuous improvement

SoA statement of applicability

2022 The current major version of ISO/IEC 27001 defines ISMS requirements for information security, cybersecurity and privacy protection.

70K+ ISO Survey 2022’ye gre 150 ülkede 70.000’den fazla ISO/IEC 27001 sertifikası raporlandı.

3 Gizlilik, bütünlük ve erişilebilirlik ilkeleri BGYS’nin temel risk ynetimi bakışını oluşturur.

4 ISO/IEC 27001:2022 Annex A controls are discussed under organizational, human, physical and technological headings.

WHY ISMS

An ISO 27001 project does not create lasting value if it is done only to obtain a certificate.

An effective ISMS; It manages information assets, business processes, human factors, technology, suppliers and legal liabilities within a risk-based framework. The Secure Fors approach focuses on establishing a security management system that lives within the organization and constantly improves, rather than documents that arrive on audit day.

The document set alone is not an ISMS. Policies, procedures and forms are important; However, without asset ownership, risk acceptance decisions, evidence of control implementation, training records, internal audit findings, and corrective actions, the system will not work in the field.

Risk analysis should be linked to the organization's real business processes. If the information assets, data flows, critical services, suppliers and business impact within the scope of the ISMS are not clear, the risk treatment plan cannot be audited and implemented.

Annex A controls are more than just a “selected/not selected” table. Controllerin kurumda nasıl uygulandığı, hangi kanıtla doğrulandığı, kimin sorumlu olduğu ve hangi lçümle takip edildiği açıkça tanımlanmalıdır.

Post-certification sustainability must be designed from the beginning. İç denetim, ynetim gzden geçirme, uygunsuzluk ynetimi, farkındalık, hedefler, metrikler ve continuous improvement dngüsü kurulmazsa BGYS hızla güncelliğini kaybeder.

CONSULTING SCOPE

An end-to-end ISMS solution for your ISO 27001 certification journey.

We start with a gap analysis according to the current maturity of the institution, make the ISMS installation operable, and complete the process with internal audit and certification audit preparation.

SCOPE AND GAP

Current State Analysis

We determine where the organization is in relation to ISO/IEC 27001:2022 requirements and what deficiencies it needs to close for certification.

Determination of ISMS scope and scope limits
Analysis of internal/external issues, relevant parties and expectations
ISO 27001 substance based gap analysis
Priority certification preparation plan

Output: Gap report, ISMS scope document and certification roadmap.

RISK-BASED ISMS

Assets, Risk and SoA

BGYS’nin kalbini oluşturan varlık inventory, risk değerlendirme, risk işleme planı ve statement of applicabilityni kurumunuza gre hazırlarız.

Information assets, data flows and asset ownership
Risk criteria, risk assessment and risk treatment method
Risk treatment plan and risk acceptance mechanism
Annex A control matching and SoA preparation

Output: Varlık inventory, risk raporu, risk işleme planı ve SoA.

DOCUMENTATION

Policy and Procedure Set

We transform standard requirements into policies, procedures, instructions, records and control forms appropriate to the operation of the institution.

Information security policy and objectives
Access, asset, incident, supplier and change processes
Business continuity, backup, logging and human resources controls
Document control, records management and evidence structure

Output: ISMS documentation set and registration templates adapted to the institution.

CONTROL IMPLEMENTATION

Annex A Controls

Controllerin yalnızca seçilmesini değil, kurum içinde uygulanmasını, sorumlusunun belirlenmesini ve kanıtla takip edilmesini sağlarız.

Organizational, human, physical and technological control implementation plan
Control sahibi, kanıt tipi ve lçüm kriterleri
Action tracking for technical security checks
Vendor, cloud, incident and vulnerability management integration

Output: Annex A control matrix, application tracking list and evidence file.

TRAINING INCLUDED

ISMS Training and Awareness

In order for the system to be sustainable, we inform the project team, process owners and employees at a level appropriate to their roles.

ISO 27001 basic awareness training
ISMS project team and process owner training
Risk analysis, internal audit and evidence preparation training
Information security awareness sessions for employees

Output: Training materials, attendance records and awareness outcomes.

AUDIT READINESS

Internal Audit, YGG and Certification

Before certification, we verify that the ISMS is working, close any nonconformities and support audit coordination.

Internal audit plan, checklist and internal audit execution
Non-conformance, corrective action and closure follow-up
Management review agenda and decision records
Stage 1 and Stage 2 certification audit preparation

Output: Internal audit report, YGG records, DPA list and audit preparation file.

ROADMAP

We manage ISO 27001 certification preparation step by step.

We work with in-house teams throughout the program. At each step it is clarified what will be produced, which team will be involved and what evidence will be shown in the certification audit.

01 Start and scope The project team, certification target, ISMS boundaries and business units are clarified.

02 Gap analysis The existing structure is compared with ISO/IEC 27001:2022 clauses and Annex A controls.

03 Varlık inventory Information assets, data flows, critical processes, suppliers and asset owners are extracted.

04 Risk analysis Risk criteria, threats, vulnerabilities, business impacts and risk owners are determined.

05 Risk processing and SoA Risk işleme planı, Annex A kontrol seçimi ve statement of applicability hazırlanır.

06 Documentation The policy, procedure, instruction, recording and measurement structure is adapted to the institution.

07 Control uygulama Control sahipleri, kanıtlar, aksiyonlar ve teknik/security süreçleri takip edilir.

08 Education and awareness Role-based ISMS training is provided to the project team, process owners and employees.

09 Internal audit and YGG Internal audit is performed, nonconformities are closed and management review is completed.

10 Certification audit Preparation, coordination and closure of findings for Phase 1 and Phase 2 audits are supported.

THE SECURE FORS DIFFERENCE

We establish ISMS with management system, cybersecurity and audit experience.

ISO 27001 consultancy is not just about converting standard clauses into documents. The organization's real information assets, cyber risks, supplier relationships, business continuity needs and technical security controls should become manageable within the ISMS.

Secure Fors, ISO 27001 ISMS kurulumunu sızma testi, zafiyet ynetimi, SOME, tedarikçi güvenliği, bulut güvenliği, KVKK ve regülasyon uyumu tecrübesiyle birlikte ele alır. Bylece sertifikasyon süreci, kurum için employee bir bilgi güvenliği ynetim sistemine dnüşür.

Consulting Deliverables

ISO/IEC 27001:2022 gap analysis and certification roadmap
ISMS scope document, internal/external issues and relevant parties analysis
Bilgi varlıkları inventory ve varlık sahipliği matrisi
Risk assessment report and risk treatment plan
Annex A kontrol matrisi ve statement of applicability
ISMS policy, procedure, instruction and record set
Training materials, attendance records and awareness outputs
Internal audit report, CPA list and management review records
Certification audit preparation file and evidence matrix

Let's determine your ISO 27001 certification preparation level together.

BGYS kapsamınız net mi, varlık inventoryniz güncel mi, risk işleme planınız çalışıyor mu, SoA kanıtlarınız hazır mı, iç denetim ve YGG süreçleriniz tamam mı? Secure Fors ile n değerlendirme yaparak sertifikasyon yol haritanızı netleştirebilirsiniz.

Request a Meeting

Standard source: ISO/IEC 27001:2022 Information Security Management Systems.