ISO 27001 Certification

1. Information and preliminary audit (optional)
   Information meeting (by telephone or in person), on-site project discussion and preparation for certification including document review
2. On-site certification
   Readiness analysis with assessment and review of the management system description, review of documented processes and optional post-audit (review of corrective actions)
3. Audit report and evaluation
   Documentation of the audit and evaluation of the management system
4. Certificate and seal
   After successful completion, you will receive your certificate and the DEKRA test seal (with a maximum term of three years)
5. First surveillance audit
   A surveillance audit of the practical implementation is conducted every twelve months
6. Second surveillance audit
   Repeated auditing of the practical implementation of the management system
7. Recertification
   Three years after initial certification, steps 2 to 6 are repeated for the recertification audit

For a time-saving and smooth certification process, you can prepare yourself by:

• Determining the scope of the ISMS
• Defining information security policy and objectives
• Developing a risk assessment and risk treatment methodology
• Creating an applicability statement
• Preparing a risk treatment plan and risk assessment report
• Defining security roles and responsibilities
• Creating an inventory of assets
• Ensuring acceptable use of assets
• Defining policies such as those for access control according to Annex A of ISO/IEC 27001

A leading international standard, ISO 27001 certification is considered to be one of the most relevant in the field of cyber security. Applicable to any company regardless of size and industry, the standard provides important guidelines in the area of planning, implementation, control and optimization of your information security.

Assessment parameters:

• The establishment of an appropriate ISMS
• The implementation of a mechanism for identifying risks, self-assessment, prevention and remediation of security gaps
• The plausibility of the defined security levels of the processed information
• The implementation of appropriate measures to ensure adequate information security