ISO/IEC 27001

Information security managed as a business system.

TD and Associates helps small and midsized organizations develop practical Information Security Management Systems that connect risk, responsibilities, documented information, performance, and continual improvement.

Information security is not solely an information-technology responsibility.

Organizations must determine which information requires protection, assess relevant risks, assign responsibility, implement appropriate controls, evaluate performance, and respond when the system does not work as intended.

TD and Associates supports the management-system framework needed to make those activities controlled, understandable, and auditable.

ISMS support

Practical help from readiness through continual improvement.

Support can address a complete implementation or a focused need such as an assessment, internal audit, corrective-action effort, or management review.

Management-system services

ISO/IEC 27001 readiness and gap assessments
ISMS scope and implementation planning
Information-security risk-assessment and treatment processes
Statement of Applicability development and review
Policies, procedures, documented information, and change control
ISMS roles, responsibilities, awareness, and training
Supplier information-security management
Internal audits and certification preparation
Corrective action, continual improvement, and management review
Integration with ISO 9001 and other management systems
Ongoing or fractional ISMS coordination

Working with your technology provider

ISO/IEC 27001 includes organizational, personnel, physical, and technological controls. TD and Associates coordinates management-system requirements with the organization’s internal IT personnel or external technology provider.

Clarify requirements, roles, and responsibilities
Connect technical activities to risk-treatment plans
Identify required documented information and evidence
Track implementation activities and unresolved gaps
Incorporate technical results into audits, corrective action, and management review
Prepare personnel and providers for certification-audit questions

Clear responsibilities

Management-system support without overstating technical scope.

The organization’s qualified internal information-technology personnel or external technology provider remains responsible for selecting, configuring, implementing, and technically testing cybersecurity tools and controls.

TD and Associates does not provide penetration testing, managed security, network engineering, digital forensics, or other technical cybersecurity services.

Explore training solutions

Preparing for certification

Build a system that can be maintained after the audit.

TD and Associates can help identify gaps, develop the management-system framework, coordinate responsibilities, conduct internal audits, and support corrective action. Independent certification audits are performed by an accredited certification body.

Services are available remotely, onsite, or through a hybrid approach.

A practical next step

Let’s talk about what your operation needs.

Project-based assistance and ongoing fractional support are available.

Contact TD and Associates