ISO/IEC 27001: do the controls operate in the systems, or on paper?
The standard for protecting the information your business depends on, and what an independent internal audit or assessment of it looks at.
Internal audits · assessments
What the standard achieves, in business terms
ISO/IEC 27001 protects the information your business processes depend on, by risk. The ISMS is the way the organization decides what to protect, how, and how it knows the controls work. Controls are chosen by what the risk assessment finds and checked against Annex A, not by the length of the list.
Why internal auditing matters here
The audit programme is your own check between certification-body visits. A good internal audit looks at whether the controls operate in the systems and the processes: access, change, logging, suppliers, incidents. Whether the Statement of Applicability is complete is a question for the first morning. What the certification body will look at next is the question for the rest of the audit.
How an independent assessment finds the weaknesses first
Gap and readiness assessments before certification or surveillance find the weaknesses before the external auditor does. An effectiveness review takes one control set or one process and asks whether it does its job. Either way you receive a plan, graded findings with their evidence, a report and a closing meeting.
How it connects to AI governance and ISO/IEC 42001
AI systems come into the ISMS's scope as supporting assets of the processes it protects. An organization certified to ISO/IEC 27001 already has most of the machinery ISO/IEC 42001 asks for, and can extend it rather than duplicate it. AI security itself is a risk domain and a control set inside the existing system.
Experience, as facts
The practice's background is enterprise technology and architecture work in large SAP landscapes, and the SOX access-control architecture at Mettler-Toledo: segregation of duties, roles and access. PECB Certified ISO/IEC 27001 Provisional Auditor.
Send us the standard, the scope and the date of your next external audit. We'll come back with an audit plan and a fixed scope.
Start a conversation
The standard, the scope and the date of your next external audit are enough to begin. We'll come back with an audit plan and a fixed scope.