ISO 27001 & ISMS

What is ISO 27001?

ISO/IEC 27001:2022 is the internationally recognised standard for information security management systems (ISMS). It helps organisations protect information systematically – whether it exists in digital or analogue form or as knowledge.

In an increasingly connected world, information security is a key success factor. The standard provides a clear framework for ensuring the confidentiality, integrity and availability of information in the long term.

Why get certified?

The controls of the standard help to mitigate risks in a targeted way – for example:

• Threats from cyber attacks
• Data theft by third parties
• Vulnerabilities caused by outdated systems
• Lack of awareness among employees

To this end, the standard specifies organisational, technical, physical and people-related measures. Together with you, we identify, assess and mitigate IT risks proactively – so that critical systems and data are protected and business continuity is ensured.

What an ISMS includes

• Scope and context – which sites, processes and systems the ISMS covers.
• Risk management – systematically identifying, assessing and treating risks to your information.
• Statement of applicability – which of the 93 controls in Annex A apply to you and how they are implemented.
• Policies and responsibilities – clear rules and roles, backed by top management.
• Measure and improve – internal audits, management review and continual improvement.

Useful tools for this are an automatically maintained CMDB as your asset inventory and XISUITE, where you map the chapters of the standard as processes and build your certification step by step.

The road to certification

We support you from the first assessment of where you stand to the certification audit – and beyond:

1. 1

   Assess where you stand

   A gap analysis shows where your organisation stands against the requirements of the standard.

2. 2

   Assess the risks

   We identify and assess the risks to your information and systems.

3. 3

   Build the ISMS

   Policies, processes and measures – organisational, people-related, physical and technical.

4. 4

   Involve your people

   Training and awareness, so that information security becomes part of everyday work.

5. 5

   Internal audit

   We check the effectiveness of the ISMS and close any remaining gaps.

6. 6

   Certification

   The certification audit is carried out by an accredited certification body – we support you throughout.

Once in operation, we look after your ISMS and keep improving it.

ISO 27001 and NIS2

Among other things, the NIS2 directive requires the organisations it covers to take cybersecurity risk-management measures and to report significant incidents, and it holds top management accountable. An ISMS according to ISO 27001 covers a large part of these measures; we add reporting channels and the involvement of management where needed.