Information security
Information Security Management System (ISMS).
We implement and maintain Information Security Management Systems aligned with ISO/IEC 27001, with ISO/IEC 27002 controls and integration with the regulatory frameworks of the financial sector, to protect the confidentiality, integrity and availability of information and achieve certification with an accredited body.
What it includes
Gap assessment and scope
Gap analysis against ISO/IEC 27001, definition of scope (processes, sites, systems), context, interested parties, security policy and objectives approved by top management.
Security governance and organization
Roles and responsibilities, security committee, normative framework (policies, standards and procedures), document management and staff competence.
Risk assessment and treatment
Asset inventory and classification, risk methodology aligned with ISO/IEC 27005 and ISO 31000, threat and vulnerability analysis, treatment plan and statement of applicability (SoA).
Control implementation
Deployment of the organizational, people, physical and technological controls of Annex A (ISO/IEC 27002), integrated with cybersecurity operations, continuity and supplier management.
Measurement, internal audit and review
Performance and effectiveness indicators, internal audit program, nonconformity management, management review and preparation of evidence for the certification audit.
Certification and maintenance
Support during certification audits (stages 1 and 2), resolution of findings and an annual maintenance program to keep the certificate and drive continual improvement.
Path to certification
From the initial assessment to the certification audit, with verifiable deliverables at every phase.
1. Assessment
Gaps, scope, policy and project plan.
2. Risk
Assets, assessment, treatment and SoA.
3. Controls
Implementation and operating evidence.
4. Verification
Internal audit and management review.
5. Certification
External audit, findings and maintenance.
Outcomes for the organization
Risks under control
Risk-based security decisions with owners, deadlines and evidence.
Recognized certification
ISO/IEC 27001 certificate issued by an accredited body, required in tenders and by corporate customers.
Regulatory integration
One system that answers to CNBV, Banxico, PCI DSS, SOC 2 and customer audits.
Reference frameworks and requirements
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27005
- ISO/IEC 27017 and 27018 (cloud)
- ISO/IEC 27701 (privacy)
- NIST CSF 2.0
- CNBV and Banxico
- PCI DSS
- SOC 2 Type 2
Related services
Cybersecurity and MDR
AI-driven CSOC, MDR, penetration testing, secure code and forensics.
See service →Resilience and business continuity (BCMS)
ISO 22301: BIA, strategies, continuity plans and exercises.
See service →Responsible artificial intelligence (AIMS)
ISO/IEC 42001: governance, impact assessment and AI controls.
See service →Shall we talk?
A managing partner will attend you personally. Free 30-minute executive assessment, in person or online.