ISO/IEC 27001 Consultancy: Information Security Management

ISO/IEC 27001 is the international standard for information security management systems (ISMS). It sets the requirements for managing, protecting and continually improving the way an organisation handles its information assets, such as customer data, financial information and trade secrets. With CE Danışmanı (CE Consultant) you get your ISO/IEC 27001 certificate through a single point of contact for the whole process.

What the standard covers

The main purpose of ISO/IEC 27001 is to help an organisation manage its information security risks effectively. Its main components are:

• Information security policy. The objectives and commitments of the organisation.
• Risk assessment and risk treatment. Identifying and assessing the risks and bringing them down to an acceptable level.
• Processes and procedures. Putting the policy into day-to-day practice.
• Monitoring and improvement. Continual monitoring, review and improvement of the system.

Why companies apply it

• Information assets are protected against threats by defined controls.
• In many sectors, laws and regulators expect a certain level of information security. A working ISMS supports the organisation in meeting those expectations.
• The certificate shows customers, suppliers and other interested parties what the organisation has committed to and what it is able to do.
• Risks are assessed in advance, which supports business continuity.
• It gives a framework for continual improvement of information security performance.
• It helps set common security expectations with business partners along the supply chain.

The process

1. Preparation and awareness. Management decides to set up the system. Managers and the relevant staff are trained.
2. Gap analysis. Current practice is compared with the requirements of the standard.
3. Policy and procedures. The information security policy and the procedures are written, with a plan for applying them across the organisation.
4. Risk assessment and risk treatment. Risks are identified and assessed, acceptable risk levels are defined, controls are selected and action plans are prepared.
5. Documentation and records. Documents are prepared and kept up to date, together with records such as training records and risk assessment results.
6. Implementation and monitoring. The system is applied and checked through monitoring and internal audits.
7. Management review. Top management reviews performance and decides on improvements.
8. Certification audit by an independent certification body.

Certification bodies and the audit

The organisation builds the system and works to meet the requirements. The certification body audits whether they are met, reports any nonconformities and issues the certificate once these are closed. Certification bodies are in turn assessed by the national accreditation body of their country, which is TÜRKAK in Turkey. The length of the audit depends on the size of the organisation.

What changed in the 2022 edition

The current edition, ISO/IEC 27001:2022, was published on 25 October 2022. Its title changed from “Information security management systems: Requirements” in the 2013 edition to “Information security, cybersecurity and privacy protection”, which reflects a wider view that includes cybersecurity. The transition period ended on 31 October 2025, so certification is now carried out against the 2022 edition.

The standard still has ten clauses. Clauses 1 to 3 are informative. The requirements start at clause 4: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. The main changes:

• Clause 4.2. The organisation determines which needs and expectations of interested parties will be addressed through the ISMS.
• Clause 4.4. The ISMS explicitly includes the processes needed and their interactions.
• Clause 6.1.3. The Statement of Applicability lists the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding any Annex A control.
• Clause 6.2. Information security objectives are monitored and available as documented information.
• Clause 6.3 (new). Changes to the ISMS are carried out in a planned manner.
• Clause 8.1. Criteria are established for the processes, and the processes are controlled according to those criteria. Externally provided processes, products and services are controlled.
• Clauses 9.2 and 9.3. Internal audit and management review are split into subclauses, without a change in content.
• Clause 10. The clause on improvement is restructured.

How CE Danışmanı helps

• Gap analysis against ISO/IEC 27001:2022
• Risk assessment, Statement of Applicability, policies and procedures prepared with your team
• Awareness and internal auditor training
• Internal audit and preparation for the certification audit

The clause structure is shared with ISO 9001, so an existing quality management system shortens the work.

Tell us about your company and we will reply with our offer as soon as possible.

Message us on WhatsApp · info@cedanismani.com · Contact form