We help organizations become more secured and competitive
ISO 27001 is one of the internationally recognized standards for information security management systems (ISMS). The main focus of ISMS is on information security, but cybersecurity and privacy protection also feature in its scope. An organisation’s focus to maintain its assets, repelling against cybersecurity attacks, and ensuring privacy laws can be shown by its ISO 27001 certification.
We provide strategic, transformational, and technical offerings in risk and compliance
- Our approach
Our approach to risk and compliance Auditing
Identify risks and vulnerabilities
Next, you’ll need to determine the risks that could compromise your security. Start by taking inventory of your information assets — consider your data storage locations, any devices or hardware that can reach your data, your network, software, and so on. Then create an extensive list of potential threats; some examples could be an employee’s laptop being stolen or an office visitor accessing an employee’s password.
Analyze and prioritize risks
Now that you have a list of potential risks, determine how critical each one is to solve for and prioritize your risk treatment accordingly. This should be determined by how likely it is for this risk to occur and how severe the impact would be if it did. Go through your list of risks and determine if the likelihood is low, medium, or high for each one and do the same for each risk’s impact level.
After you’ve set the likelihood and impact levels for each risk, use that information to prioritize the risks you need to address first. The risks that have both a high likelihood and a high impact ranking should be considered high-priority.
Mitigate identified risks
Next, you’ll need to use that list to take action on those risks. Look at each risk and determine ways to make it less likely to occur and reduce its impact. Identify which of the ISO 27001 Annex A controls to use to mitigate each one. Be sure to keep records of the Annex A controls you used for each risk so you can include this in your Statement of Applicability for your auditor to review.
Complete risk reports
You’ll need evidence to prove that you’ve performed your risk assessment as well since your auditor will need to verify that you’ve done this step during your audit.
To ensure you have sufficient evidence, create the following reports for your auditor:
You may also want to consider starting your Statement of Applicability (SoA) at this stage as well as this document details how you’ve treated the risks you’ve identified. The SoA is a detailed report of the ISO 27001 controls you’ve implemented as a result of your assessment.
Continually monitor and review your ISMS
Proper risk assessment is an ongoing process, not a one-time task. Whenever there are changes to your data storage, your network, or other aspects of your operations, new risks can arise. As part of your ISO 27001 risk assessment process, create a plan to continuously monitor for new risks or any changes that could alter the likelihood or impact of known risks. ISO 27001 certification requires you to conduct a full risk assessment at least once per year, but additional routine risk assessments will help you stay secure year-round.
- Client success in Risk Management and Compliance
Expected loss reduction
We assisted a leading merchant acquirer in the travel and airline industries with risk management and compliance, resulting in reduced exposure, lower expected losses, and increased profitability in high-risk sectors during a crisis. We successfully reduced the client’s exposure by over one-third and mitigated expected losses by approximately 85% during this turbulent period.
Uplift
A global USA bank partnered with us to enhance their treasury, asset and liability management operating models, as well as their liquidity and interest rate risk management process. Through this transformational engagement, we made revisions to the client’s behavioral models and hedging strategy
Automotive industry
We designed and implemented a global integrity and compliance program for a world-leading automobile manufacturer. The program focused on implementing processes and inspiring people, strengthening governance and processes across more than 500 legal entities worldwide. Through diverse communication, training, and enablement initiatives, we engaged all employees on the path to achieving sustainable culture change.
Client results
Explore our success stories to see how we have helped businesses like yours overcome challenges and achieve tangible results.
Related Insights
