The ISO/IEC 27001 standard was created with the aim of establishing the foundations for an ISMS (Information Security Management System), using as a reference framework the 12 areas of action defined in the Code of Practice for Information Security Management identified in the ISO/IEC 27002 standard.
ISO 27001 · ISMS
Management Systems
ISO 27001
Information is one of the main assets of organizations, and its loss of confidentiality, integrity, or availability can even jeopardize their continuity. For this reason, adequate protection systems and proper security management are necessary.
Differential Analysis
Gap analysis vs. ISO/IEC 27002
ISMS Implementation
Design and implementation of the Management System
Internal Audit
Verification of conformity and effectiveness of controls
Certification
Preparation and attainment of the ISO 27001 certificate
The standard
What is ISO 27001?
Our services
How we work
01Differential Analysis
Internet Security Auditors proposes an ISO/IEC 27002 Gap Analysis as a first step towards achieving an ISMS in accordance with the international ISO/IEC 27001 standard. This analysis of the current state of information systems security covers Management aspects (documented policies, regulations, and procedures), Legal aspects (laws and contracts), and Technical aspects (architecture, tools, and applied technologies).
- Understand applicability and the gap: Determine the applicability and gap regarding ISO/IEC 27002 standards.
- Assessment of current security measures: Obtain an independent assessment of the current state of the security measures adopted by the organization.
- Security improvement plan: Determine a security improvement plan tailored and specific to the organization.
- Raise awareness and accountability: An opportunity to raise awareness and assign responsibility to the different areas of the company regarding the importance of information security from a management perspective.
- Guide the implementation of an ISMS: It is the first step towards the implementation of an ISMS according to the international ISO/IEC 27001 standard.
02Implementation of an ISMS according to ISO/IEC 27001
To successfully implement an ISMS, full commitment and support from management for the project and a correct ISMS design are necessary. This design must identify and document the scope and objectives of the ISMS, creating the company's security policy, inventorying assets to be included in the scope, and performing a risk analysis to be able to carry out, based on the threats, vulnerabilities, and impacts, an assessment and subsequent risk management that allows us to select the necessary controls to minimize existing risks and thereby select the applicable controls from the annex of the ISO/IEC 27001 standard.
The objectives of implementing an ISMS are summarized as follows:
Main Benefits
What this service covers
Clear objectives and guidelines
Clear definition and communication of security objectives and guidelines throughout the organization.
Consistency in actions
Systematization, objectivity, and consistency over time in security actions.
Risk analysis and prevention
Analysis and prevention of risks in Information Systems.
Process improvement
Improvement of information management processes and procedures.
Staff awareness
Staff motivation regarding the valuation of information.
Regulatory Compliance
Compliance with current legislation.
Quality image
Quality image in the eyes of clients and suppliers.
Testimonials
What our clients say
Working with Internet Security Auditors has been a highly satisfactory experience. Their support during our migration to the ISO/IEC 27001:2022 standard, the execution of internal audits, and the PCI DSS certification process have been fundamental to strengthening our information security management system.
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance our cybersecurity maturity more quickly.
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a 100% online-oriented company, the professional services provided by Internet Security Auditors give us support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.
As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company aims to provide to each and every one of our clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently complete a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team enables us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.
Frequently Asked Questions
We answer your questions
How long does it take to implement ISO 27001?
It depends on the size and maturity of the organization. In medium-sized companies with defined security processes, implementation and preparation for certification typically range from 4 to 8 months. We conduct an initial gap analysis to estimate the scope and actual timelines.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 establishes the requirements for implementing an Information Security Management System (ISMS) and is the certifiable standard. ISO 27002 is the code of practice that defines recommended security controls. They are complementary: ISO 27001 states what must be done, and ISO 27002 provides guidance on how to implement the controls.
Is an internal audit mandatory?
Yes. Requirement 9.2 of ISO/IEC 27001:2022 requires internal audits to be conducted at planned intervals to verify the conformity and effectiveness of the ISMS. This can be performed by qualified internal personnel or by an independent third party such as Internet Security Auditors.
Does my organization need ISO 27001 if it already has ENS?
The National Security Framework (ENS) and ISO 27001 have different but complementary objectives. The ENS is mandatory for the Spanish public sector, while ISO 27001 is a voluntary international standard. Many organizations maintain both certificates, as the controls overlap and integration is straightforward.
What deliverables do we receive upon completion?
Depending on the contracted service: gap analysis report with improvement plan, complete ISMS documentation (policies, procedures, SoA), internal audit report with detailed findings and opportunities for improvement, and certification action plan.
Contact
Do you need to implement or certify ISO 27001?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Global Presence
Our offices
Bogotá
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)
25
years of experience in cybersecurity
Contact us