ISO 27001 standard facilitates the achievement of regulatory compliance and other best practice standards such as:

• SOC 2 Type II
• PCI DSS
• HIPAA
• Global privacy regulations
• CSA Star level 2
• TISAX
• NIST Cyber Security Framework

However, implementing ISO 27001 represents a significant transformation that demands a considerable investment of time and resources from your already busy key personnel. Our simple yet comprehensive approach helps your leadership and management team seamlessly manage the complexities of ISO 27001 certification. RightCue consultants adapt key ISO 27001 processes and mandatory requirements to align with the distinct culture of your organisation, thereby reducing disruption, promoting employee engagement, and fostering accountability.

Stages of ISO 27001 implementation

Stage 1: Gap assessment
A full gap assessment enables us to gain an insight into your business goals, organisation culture and assess the maturity of existing information security processes. Leveraging what is already working well, we create a detailed plan for you, which allows you to make informed decisions regarding budget of the project, what you can do internally and where you need external expertise. Additionally, it enables you to create a realistic timeline for the project.

Stage 2: Laying the foundations
Working closely with your internal teams, we identify your organisation’s most valuable information assets or crown jewels. We document data flows and interactions between systems, whether these are in traditional networks, cloud-based systems, or a blend of both. We provide you with information security policies and other mandatory documentation which have been adapted to your business.

Stage 3: Implementation
From launching the new policies until certification, we are available to your team to provide training and advice as needed to simplify, adapt, interpret, and demonstrate compliance to the adopted policies, which includes a selection of tools and technical controls. Our unique approach allows you to identify and address key risks while also building key capabilities within your team such as security risk management, business continuity planning, cyber incident response, and management review. This ensures that your organisation is equipped with the necessary tools and expertise to manage potential security threats and incidents.

Stage 4: Mock certification audit
A RightCue consultant who is independent of the implementation team carries out a simulation of the actual audit. This allows you to gain a better understanding of the certification process and what to expect during the actual audit. Not only this is a pre-requisite of certification, a mock-certification audit allows your teams to gather the necessary documentation, and ensures that everyone is familiar with the requirements of the certification standard as relevant for their role.

Stage 5: Certification assistance
We aim to make the certification process as stress-free as possible for you. This includes managing your interaction with the certification body. Our services include supporting you during the audit process and helping you to address any concerns or observations raised by the auditor both during and after the audit.

Our expertise includes:

• Supply chain risk assessments
• Security audits for all types of systems
• Knowledge of industry best practices such as CIS, NIST, as well as ISO 27001
• Penetration testing
• Vulnerability assessments
• Data Privacy and GDPR
• Knowledge of market leading security tools and solutions
• Cyber Essentials and Cyber Essentials Plus
• Cloud security assessments