ISO 27001 information security management: scope, risk treatment, Annex A controls, internal audit and the certification audit process, explained.
A consultant brings judgement, a platform brings continuity, and neither operates your security controls. What each delivers for ISO 27001 and what to ask before choosing.
The initial ISO 27001 audit runs in two stages. What Stage 1 reviews, what Stage 2 tests, how nonconformities are graded and who makes the certification decision.
Phishing simulations are only useful if you measure the right things. How to design realistic campaigns, which metrics matter, and how results count as ISO 27001 and ENS evidence.
Vulnerability scans and penetration tests answer different questions. What each one covers, how often to run them, and what ISO 27001 and ENS expect, using PHP2Shell as a worked example.
How to run an ISO 27001 risk assessment that auditors accept: what clauses 6.1.2, 6.1.3 and 8.2 require, how to score risks and how results feed the SoA.
ISO 27001, SOC 2 and TISAX share much of their control ground but produce a certificate, a report and a label. Where they overlap and what differs.
What an ISO 27001 Statement of Applicability must contain, how to decide which Annex A controls apply, how to justify exclusions and what auditors test in it.
What a virtual CISO is, what it handles in practice, how it differs from a full time CISO or an MSSP, and the signs a company needs one.
What ISO 42001 adds for a company that already holds ISO 27001: role classification, the AI impact assessment, data provenance, transparency and AI incidents, with an implementation order.
What ISO 27001 requires for security awareness: clauses 7.2 and 7.3, Annex A control 6.3, what a compliant programme contains and the evidence auditors check.
A practical guide to choosing compliance software in Spain, built around the two questions that actually decide it: framework coverage including ENS, and whether the platform operates your security.
A consultant delivered documents, the certificate arrived, then the project stalled. How to restart ISO 27001 without starting over, with the surveillance audit close.
Most companies that think they have an ISMS just have a folder of policies. What a management system really is, and how to tell the two apart.
Where ISO 27001 and the Esquema Nacional de Seguridad genuinely overlap, where they do not, and how to build one management system that satisfies both.
Leave us your data and we will get in contact with you shortly.
