Challenge
Enterprise clients in the region were requiring ISO 27001 certification as a condition of contract. The company had informal security practices and no documented management system.
What we did
- Ran a gap assessment against ISO 27001 and defined the certification scope.
- Carried out a risk assessment and produced the Statement of Applicability.
- Wrote practical policies, procedures and work instructions that staff could actually follow.
- Delivered awareness sessions, ran the internal audit and facilitated management review.
- Supported the team through the certification audit and liaison with the certification body.
Outcome
The company went into the certification audit with a working management system and a trained team. Certification removed a barrier in client tenders and gave it a repeatable process for continual improvement.
Client names and identifying details are withheld to protect confidentiality.
All case studies