Our ISMS boundary is unclear.
WORK
Define scope, assets, roles and context.
OUTPUT
ISMS scope and governance model.
Information security management
Build security governance that can be proven.
Support ISMS design, risk assessment, control implementation, evidence preparation and internal review around the organisation's real systems.
01 /STARTING SITUATIONS
Start with the actual situation.
Risk decisions are not linked to controls.
WORK
Assess and treat risk; map applicable controls.
OUTPUT
Risk register, treatment plan and SoA support.
Audit evidence is scattered.
WORK
Connect policies and operation to reviewable records.
OUTPUT
Evidence plan, internal audit findings and action plan.
02 /THE WORK
Defined work, reviewable outputs.
ISMS foundation
Define scope, context, assets and ownership.
- Scope and context
- Asset inventory
- Roles and governance
Risk treatment
Connect risk decisions with controls and an implementation plan.
- Risk methodology
- Risk register
- Statement of Applicability support
Operation
Embed policies, processes and evidence into day-to-day operation.
- Policies and procedures
- Control ownership
- Evidence management
Internal assurance
Prepare internal audit, management review and remediation.
- Internal audit support
- Management review
- Corrective action tracking
03 /REVIEWABLE OUTPUTS
Outputs tied to the agreed scope.
- 01ISMS scope and governance model
- 02Risk methodology and register
- 03Statement of Applicability support
- 04Policy and control documentation
- 05Internal audit findings and action plan
NEXT STEP
Define the right first engagement.
The first discussion defines the objective, scope and expected outputs.
Discuss the work