From informal management to a governed ISMS.
ISO/IEC 27001 defines the requirements for an information security management system. Readiness is not about filling out templates: it requires connecting context, risks, objectives, responsibilities, controls, measurement and continuous improvement.
Phases of the journey
- analysis of the context, interested parties and requirements;
- definition of the ISMS perimeter;
- risk assessment methodology and acceptance criteria;
- risk assessment and treatment;
- Statement of Applicability and justification of the controls;
- policy, roles, skills and awareness;
- objectives, indicators and monitoring;
- document management, non-compliance and improvement;
- internal audit and management review.
Technical component
NESQ verifies that the declared controls are reflected in real configurations and processes: access, assets, patches, logging, incident response, backup, cloud and suppliers. Where gaps emerge, actions, owners, deadlines and verification methods are defined.
Preparing for the audit
The path organizes evidence, simulates interviews and sampling and helps identify inconsistencies before the external audit. NESQ does not carry out certification activities: certification is issued exclusively by accredited and independent bodies.
Results
- gap analysis and implementation roadmap;
- risk register and treatment plan;
- proportionate document set;
- evidence of controls and indicators;
- internal audit and improvement plan.