ISO 27001 FastTrack™ Consultancy Case Study

Colehouse Group is a change execution consultancy with a background in the financial sector. To support its growth and help secure government contracts, the company needed to demonstrate that it could protect client and operational data to internationally recognised standards.

Recognising IT Governance as an expert in ISMS (information security management system) implementation, it opted for our ISO 27001 FastTrack™ consultancy service, a fixed-price package designed to help smaller organisations reach ISO 27001 certification readiness in six months or less.

The Standard sets out the specifications for a risk-based ISMS comprising policies, procedures, guidelines, and associated resources and activities that, collectively managed by an organisation, protect its critical information assets.

Implementing an ISMS enables an organisation to secure its information in all forms, increase its resilience to cyber attacks and, because it is based on regular risk assessments, adapt to evolving security threats while reducing the costs associated with information security.

Annex A of the Standard contains a comprehensive list of 93 security controls and control objectives, which are typically selected and implemented as part of a formally defined risk management process.

Independently audited certification to ISO 27001 is recognised around the world as an indication that an organisation has implemented and maintains information security best practice. As such, certification removes the need for individual security audits when tendering for new contracts.

Another advantage of certification is that it helps demonstrate that the organisation has implemented the “appropriate technical and organisational measures” required by the UK and EU GDPR (General Data Protection Regulation) and other international laws and regulations.

The project began with a gap analysis to assess the organisation’s existing security controls and identify those needed to meet the requirements of ISO 27001.

A dedicated consultant developed a delivery plan, created the required ISMS documentation and worked closely with Colehouse to complete key project activities. These included:

• Carrying out the mandatory information security risk assessment.
• Completing the ISMS documentation, including a handover training session to help the client navigate the ISMS and locate relevant documentation
• Facilitating the first management review meeting.
• Conducting an internal ISMS audit to identify and address any remaining gaps before the certification audit.
• Providing a project handover session to ensure the client could maintain and improve the ISMS post-certification.

To maintain audit objectivity, the internal audit was carried out by a second consultant who had not been involved in the ISMS development.

IT Governance also helped the client select a UKAS-accredited certification body that could deliver a cost-effective and timely certification audit.

The project was delivered remotely over a three-month period. Despite limited internal resource, the project remained on track thanks to clear timelines and the proactive engagement of both parties.

Designed for small organisations with up to 20 employees, this fixed-price service helps clients achieve ISO 27001 certification readiness in six months or less.

We will help with the following:

• Implementing a complete, documented ISMS that addresses your specific information security risks and business objectives.
• Documenting the necessary information security processes using the documentation templates on our CyberComply platform.
• Establishing a programme to improve information security awareness across the organisation.
• Helping you develop the skills needed to manage, maintain and improve your ISMS.
• Facilitating the first management review meeting.
• Conducting an internal ISMS audit before certification.
• Selecting the right accredited certification body for you.

The ISO 27001 FastTrack service also includes subscriptions for the following:

• IT Governance’s CyberComply. Our compliance automation platform contains everything you need to manage information security risk assessment, incident response, data flow mapping, legal compliance, supplier management and more. It includes complete documentation toolkits for your ISMS and a range of other management systems, legal requirements and compliance requirements such as the GDPR (General Data Protection Regulation) and the PCI DSS (Payment Card Industry Data Security Standard).
• Our online Information Security & ISO27001 Staff Awareness E-Learning Course.

Clients are also assigned a qualified consultant, who will undertake all the key activities of setting up an ISO 27001-aligned ISMS that reflects their business objectives and requirements, and is suitably scaled to the size of the organisation.

During the engagement, the consultant uses the specialist tools in CyberComply to ensure comprehensive coverage of the Standard and ensure you are capable of maintaining your certification in the long term.

Find out more and book a scoping call