Information security program
Preparation and ongoing support with ISO/IEC 27001 and 27701, NIST CSF 2.0 or CIS Controls v8.1.
- 01THE PROBLEMPressure from clients or contracts for a security management system, without knowing where to start.
- 02WHO IT IS FOROrganizations that need to structure controls and produce security and privacy evidence.
- 03INTENDED OUTCOMEManagement system in place, controls backed by evidence and follow-up that supports audits.
What changes for decision makers.
- FOR THECEOAnswering customers and contracts“Customers and contracts ask for an information security management system the company cannot show.”A management system in place, with evidence to answer whoever asks.
- FOR THECFOInvestment where it matters“Controls purchased without knowing which risks they address.”A treatment plan that links every control to a risk.
- FOR THECTOControls that work“Written policy, different practice.”Controls in place with evidence; technical controls can be operated by ness.
- FOR THECISOReady for the audit“The certification audit is approaching and the evidence is scattered.”Internal audit performed by trustness. and evidence organized in n.360.
A management system that sustains itself.
The framework is chosen based on the goal: certification, a client requirement or internal maturity.
Scroll sideways to see the whole diagram
- ISO/IEC 27001
- Information security
- ISO/IEC 27701
- Privacy
- NIST CSF 2.0
- Cyber risk management
- CIS Controls v8.1
- Prioritized controls
Controls and evidence in n.360.
Each control with an owner, status and evidence, tracked in real time in n.360. At each periodic review, leadership sees maturity by domain and what is still needed for the audit.
Plan, do, check, act.
A management system does not end at the audit. It is reviewed every cycle.
- STAGE 01PlanWhat scope and which risks?
- STAGE 02ImplementWho owns each control?
- STAGE 03VerifyDoes the control work, and is there evidence?
- STAGE 04AuditWhat did the internal audit find?
- STAGE 05ImproveWhat changes in the next cycle?
How this works in practice.
- Ionic HealthGovernance on an international journey
- SITUATION
- Ionic Health develops software as a medical device and is on an international expansion journey.
- WHAT WE DID
- trustness. took part in the governance and standards journey; ness. supported the secure development lifecycle and security operations.
- RESULT
- Governance and security practices built into the development lifecycle.
Preparation and ongoing support.
trustness. prepares and supports. Certification is decided by the certification body.
- RISKSAnalysis and treatmentDocumented method and periodic review.
- POLICIESDocuments people actually useShort policies, with an owner and a version.
- EVIDENCEOrganized in n.360Ready for whoever needs to verify them.
- AUDITInternal, if contractedBefore the certification audit.
Why trustness.
- 01Audit readinesstrustness. prepares, implements and follows up; certification is granted by the certification body.
- 02Internal auditThe internal audit is performed by trustness., independent from whoever implemented the system.
- 03Family of standardsISO/IEC 27001 and 27701 and other information security standards, such as ISO/IEC 27002, 27005, 27017 and 27018, ISO 22301, NIST CSF 2.0 and CIS Controls v8.1.
- 04Organized evidenceControls, owners and evidence in n.360, ready for the audit.
- 05Technical controls operatedTechnical controls can be operated by ness., through n.infraops and n.secops.
Stages of the work.
- 01Maturity and scope assessment
- 02Statement of Applicability (SoA) and treatment plan
- 03Implementation of controls and evidence
- 04Internal audit and follow-up
What is included.
How we work with what you already have.
trustness. prepares and supports; certification is decided by the certification body. Technical controls can be operated by ness.
- 01Your teamIs accountable for the processes and controls of its daily work; trustness. runs the method and the internal audit.owners of the controls
- 02The toolsThe ones you already use become sources of evidence; technical controls can be handled by ness.kept as evidence
- 03Certification bodyPerforms the external audit and decides on certification. trustness. prepares you for it.independent
| Activity | trustness. | Your team | Third parties |
|---|---|---|---|
| Assessment and scope | executes | approves | — |
| Risk analysis and applicability | executes | approves | — |
| Control implementation | coordinates | executes | supports |
| Internal audit | executes | supports | — |
| Certification audit | supports | supports | executes |
Three models, as set in the contract.
- MODEL 01Compliance programImplementation of the management system, up to preparation for the certification audit.
- MODEL 02Posture assessmentMaturity assessment against the chosen standard, with a prioritized plan.
- MODEL 03AuditIndependent internal audit of the management system.
What people usually ask us.
Do you certify the company?
No. trustness. prepares you for the certification audit and performs the internal audit; certification is granted by the certification body.
Which standard should we choose?
It depends on what customers, contracts and the business require. ISO/IEC 27001 and 27701 are the most requested; CIS Controls v8.1 and NIST CSF 2.0 are good starting points at early maturity.
How long does it take?
It depends on the scope and current maturity. The assessment defines the plan and timelines.
Who operates the technical controls?
Your team, or ness., if you contract n.infraops or n.secops.
What happens after certification?
The management system needs maintenance: trustness. follows up and performs the internal audits for the following cycles.
Want to know if Information security program fits your situation?
- conversation
- assessment
- proposal