A multitude of factors contribute to obtaining the ISO certification. Depending on the size of your team, the complexity of your IT Infrastructure and the time that you are willing to put into it. @Compleye we designed a 5-day Roadmap, depending on your resources we can guide or implement for you.
In our Templates Section we have uploaded an one-pager with tips on how to behave during audit, to share with your team.
From a practical point of view:
- Your external audit company will provide you with an agenda.
- You do not have to send anything to the auditor in advance
- First things the auditor will ask for are:
- The SoA
- Your scope (in the mandatory document Ch4-10)
- It is “his/her day” so they are in the lead.
- Read the Mandatory Topics Ch4-10 and your Management Review report a day before the audit to be prepared.
- Use the Audit View section as your cheat sheet during the audit.
More info about external audit for ISO27001 check this out.
No, a certification body who is a member of the International Accreditation Forum (IAF), and additionally ISO/IEC 17021:2015 certified, will issue the certification.
Compleye support you in your challenge by providing tooling (compleye online) and services.
More information on Audit Firms check this out.
If you are a B2B company, with your own developed product, the first requirement will be ISO 27001 – International standard for Information Security Management System (ISMS).
This covers topics from Business, Legal, IT Infrastructure, Development and Security organization.
We call it your license to operate – great first step and foundation to build other frameworks on top and it includes the yearly check on laws and regulations.
Do realise that just the external audit company are not the only costs involved. Below a list of topics to consider:
- External audit company
- Internal audits
- PEN Testing
- Vulnerability Scanning tooling
- Password management tool
- Compliance Tooling
- Internal resources: Security Officer, Privacy Officer, Compliance Officer
- Supporting roles: DevOps, Management, HR and legal
- Security Awareness Program for entire team.
- Time spend on security meetings and yearly assessments
- Time spend for internal and external audits.
Yearly you will mature your security system and implement improvements.
Compleye supports you to start with a lean ISMS system in your first year and slowly mature – based on your organisation and budget.
Please bear in mind, that every additional framework that you ad on top of your ISO27001, might cost you double the resources or budget.
More info on costs for external audits, check this out.
Considering that you are a small sized company (<10 fte) The minimum budget for an ISO27001 framework is:
- Costs of your external audit. (approx 8-12 KEuro for 3 years)
- Support of your choice (platform and/or services)
[Compleye offers platform and monthly guidance for low budgets] - Costs for Internal Audit, if you outsource. [Compleye IA offer]
- If you have no budget for PEN Test you might consider other options e.g. External Assessment by someone in your network, social hacker option etc.
More important is to realise that Security & Privacy compliance is not something that you can turn on and off… it is important for every business and mandatory if you want to do business with corporates and governments. So ensure that you have assigned budget.
Security Officer, Privacy Officer and Compliance Officers are not fulltime jobs. In smaller sized companies some of the roles are combined, depending on the knowledge and competencies of the people.
Compleye supports SMEs if they do not have the resources or knowledge and can take over the roles of Privacy Officer, Compliance Officer and Internal Auditor.
For Security Officer we make use of our network of experts and can find the support you will need.
Please check out the role description of:
Right now, if you are searching for information, it probably means that one of your customers has already made some requests.
So today with your first step on the compliance roadmap and book a demo with us to find out how quick you can be ISO27001 certified.
The General Data Protection Regulation (GDPR) of the EU requires a set of privacy documents and security policies. The security policies should be implemented and controlled. Because without security measures you cannot protect the privacy of the data.
So you will need to implement a set of security policies under GDPR. It is your own responsibility to determine if the security measures are enough for business.
Compleye can support you in a GDPR program to setup an GDPR statement for your customers and together we define what measures are needed.
For companies with a IT product or service that will not be enough.
- Your customers will demand more assurance (e.g. ISO27001 certificate)
- Or you will need to comply with national laws and regulations (e.g. NIS2, DORA etc.)
ISO 27001 does not require a specific number of policies to be implemented.
The policies depend on the type, capacity and services of your organisation.
Compleye provide all the templates needed to comply with ISO27001. We review and improve them every year, sharing best practices while working with clients.
Try our platform for free to have a sneak preview or book a demo and we will show our Templates section.
Not necessarily in your first year of ISO27001, however:
- it will become mandatory if you adopt other frameworks (e.g. SOC-2)
- it is recommended if you mature your ISO27001
- if will become part of sales processes with corporate customers.
Until that moment there are good (and cost efficient) alternatives to stay compliant with ISO27001.
During our services we share best practice to provide you with alternative solutions.
You can buy the ISO27001 standard via the ISO organisation. https://www.iso.org/standard/54534.html
Compleye is not allowed to share a copy of the standard for free to our clients – copyrights are reserved by ISO Organization.
It is important to have a list of all the requirements, especially during external audit, when auditors refer to specific requirements.
However, if you make use of the Compleye Services there are ways to avoid this purchase and still be informed and kept up to date with the ISO27001 requirements.
- Compleye Internal Audit Service: we use the entire requirements list and report non-conformities.
- On our platform we have section Audit View – with a list of all high level requirements.
Please use this link for the overview of the sections of the platform.
We have listed all the general features in this overview. Think of:
- Activity log
- Email reminders
- Access Management
- etc. etc.
