ISO 27001 Services - Audits & Compliance

What is an ISMS?

While ISO27001 specifies that compliant organisations should have an Information Security Management System (ISMS), the standard does not mandate the specific content it should contain.

An ISO27001 ISMS is a set of policies, procedures and controls that address the people, process and technology risks an organisation faces. An ISMS does not specifically focus on tools and technologies but on risks and controls that keep information assets secure. It gives organisations a systematic approach for protecting all information whether it’s stored electronically or on physical media.

ISMS Internal Audit

An ISMS audit includes looking at several key elements. These are:

1. Your information security objectives
2. A list of all information assets
3. A list of all stakeholders and their expectations
4. The risks for each information asset
5. The controls and mitigation strategies, including implementation plans, for each of the risks
6. A measurement system so the performance of those controls and strategies can be monitored, maintained and continuously improved

ISO27001 does not specify precisely how the ISMS is to be constructed. It does, however, document what documents are required in order for the ISMS to be ISO27001 compliant.

Why does ISO27001 certification matter to your organisation?

Information security is a high-priority issue for all organisations. Customers, suppliers and other stakeholders are all part of a highly connected ecosystem, making the protection of data a key priority for everyone. ISO27001 certification provides assurance that you can be trusted to protect information and that you have considered the risks your organisation, and its supply chain faces, and have put into place appropriate mitigation strategies.

Reduce the risk of unauthorised access and data extraction

Being certified to ISO27001 provides assurance that you have implemented the baseline measures in place to manage information and information systems and reduce the risk of unauthorised access and data extraction. It enhances your defences and reputation as it forces you to take information security seriously and documents that you have been accredited by an independent auditor.

With many countries, including Australia and New Zealand, adopting data protection laws, operation of an ISMS aligned or certified to ISO27001 can prevent the risk of a breach of systems and data by cybersecurity advisory services. Being ISO27001 certified shows customers, suppliers and regulators that you have taken reasonable steps to protect your data and mitigate risks in a way that is appropriate for your organisation.

ISO27001 provides structure to your cybersecurity strategy

ISO27001 does not mandate specific controls but it can provide structure to your cybersecurity strategy. Because it focuses on the risks that matter to your organisation, it avoids taking a reactionary approach to specific threats and provides a framework that enables you to be prepared for a broad range of risks by taking a holistic view of your threat environment.

How can Tesserent help?

Tesserent has delivered ISO27001 ISMS review and remediation services over many years, across a diverse range of industries and clients. That broad and deep experience means we can help organisations identify risks and put in place appropriate controls that ensure their data is as well protected. Our staff are certified as ISO27001 Lead Auditors, amongst other certifications, and can assist you in the development, design, remediation and assessment of your requirements. Our ISO27001 ISMS services can be tailored to your requirements and may include:

• ISO 27001 Gap Analysis and Advisory

• ISO 27001 Control Development & Remediation Services

• ISO 27001 Certification and Surveillance Audits (Completed by a Partner Organisation)

Tesserent’s broad ISO27001 services include comprehensive reviews of all your documentation, interviews with key stakeholders and the production of a gap analysis report that will guide your path towards compliance. This includes a comprehensive presentation to management that outlines the risks, how they can be mitigated and how ISO27001 compliance will help the organisation as it moves forward in its cybersecurity journey.

And once you have achieved ISO27001 compliance, Tesserent's suite of cybersecurity services can help you with regular reviews and advice on how to continually improve your security posture and be prepared for emerging and potential new threats. This ensures you have an eye on continuous improvement and not simply on just passing audits.