Steel FYI is not a certification body and therefore cannot conduct the final audit and present certifications. We can however help with the design, implementation, and operation of your ISO 27001 ISMS and get you ready for the certification. We are partnered with an excellent certification body who specialises in startups with a modern tech ecosystems and can assist in the scheduling of your final external audit.

The internal audit is a incredibly useful exercise that allows for review of the ISMS that addresses elements of efficiency and effectiveness and facilitates significant improvement on the operations of the organisation. The internal audit is part of requirement 9.2 and requires that the assessor be qualified and objective. With over 10 years experience in information. and cyber security, and holders of the ISO 27001 Lead Implementor, CISSP, and CISM certifications we are qualified to conduct the internal audit. If we have assisted with the implementation of the ISMS we would not objective and therefore unable to provide the internal audit. However we work with a number of partner auditors who we can enlist and arrange to provide the internal audit.

That depends! For our average customers around 1-50 employees, without physical locations, working on a SaaS product, we usually look at around 3 months for implementation, and an additional 3 months for running of your information security management system so that we can build up enough of an evidence base to pass the external audit with ease. Of course there's a number of factors that will impact this, but 3-6 months is about the average.

Broadly, the process would involve first understanding the organisation through a series of meetings with internal leadership, review of documentation, review of capabilities, and review of the technical estate. This would defined the internal and external context which would be used to produce the beginnings of an ISMS Plan. This would then lead to defining and agreeing security objectives, agreeing what resources are required, reviewing competence of employees, and documenting a communications plan. We would then conduct an organisational wide risk assessment in a workshop with leadership where we review and agree appropriate risk treatment plans to address these risks, aligned to the controls of Annex A. We would then work with the internal teams to ensure these controls are implemented and documented as defined by the risk treatment plans. This would include creation and dissemination of policies and delivery of training as necessary. Once the implementation is in place, a management review would be conducted to assess the effectiveness of the ISMS and identify opportunities for continuous improvement. An internal audit would need to then be conducted. Once we remediate any nonconformance identified by the internal audit we would begin enlist the stage 1 external audit from the certification body which is a documentation review to assess readiness. Assuming we get the green light to go forward after remediating any further non conformance, we would proceed to stage 2 where I would work alongside the business as the security officer to ensure that the audit goes smoothly, the business is supported, and that certification is achieved