Establish and Evolve your ISO Program
ISO/IEC Standards are globally recognized best practices that help companies design, implement, and operate InfoSec management systems.
ISO 27001 contains a set of requirements that organizations must follow to define their own scope, select the security controls they need, and monitor and improve the security program over time.
This core set of processes within ISO 27001 is called the Information Security Management System (ISMS).
Only the controls that the organization deems necessary via this ISMS process are assessed, so organizations do not need to implement every single control in ISO 27001.
The ISMS clauses are the core of ISO 27001 and contain requirements for the management of the InfoSec program rather than technical controls.
Examples of required processes in the ISMS clauses include:
- Determining the issues facing the organization
- Conducting a risk assessment
- Having document management processes
- Retaining change control processes
- Measuring security performance
With certified ISO/IEC Lead Implementers and ISO/IEC Lead Auditors, TrustedSec can help ensure that your ISO program is effectively designed, appropriately implemented, and achieves your objectives.
Related Links
“Having access to industry leaders right here at TrustedSec makes solving our clients' challenges easier.”Paul SemsManaging Director of Remediation Services
Paul Sems
Managing Director of Remediation ServicesPaul and his team work with clients to harden their environments against attacks and help them recover after security incidents.
Browse our blogs and webinars
Demystifying ISO 27001: From Certification to Integration
Learn how to simplify your ISO 27001 compliance journey with Chris Camejo, Compliance Services Practice Lead, and discover how to navigate complexities and…
Introduction to MITRE Mapping - Cloud, On-Prem, and Active Testing Techniques
Whether you're just getting started with MITRE ATT&CK® or looking for ways to improve your tactics, this session will give you practical knowledge to…
ARP Around and Find Out: Hijacking GPO UNC Paths for Code Execution and NTLM Relay
TL;DR - If you have WriteGPLink on an Active Directory Organizational Unit (OU) and you’re on the same network segment as a computer within that OU, you can…
Kerberos with Titanis
In this article, I’ll walk you through the basics of Kerberos, how to use Titanis for the different parts, and how to mitigate some problems.Titanis SetupI use…
Mythos, Memory Loss, and the Part InfoSec Keeps Missing
InfoSec has a bad habit of acting like history started this morning. Something new lands, the industry loses its mind for a week, vendors start talking like…
Dungeons and Daemons
Play Roll for Initiative. Hack the Planet.Dungeons & Daemons is a cybersecurity RPG that drops you into the boots of a Red Team operator on a live…
You Had Us at the First Alert: A Guide to Finding Frequently Missed Detections
Join us for this webinar to get a clearer picture of where your detection coverage has blind spots and a practical roadmap for closing them before a real…
Benchmarking Self-Hosted LLMs for Offensive Security
We put LLMs to the test—let's find out how good AI is at hacking! We walk through six simple challenges with intentionally naïve setups to test how capable…
IAM the Captain Now – Hijacking Azure Identity Access
I decided to spend some research time diving in depth into Identity and Access Management (IAM) within Microsoft Azure. I am going to show you within this blog…
Building a Detection Foundation: Part 5 - Correlation in Practice
From Data Sources to DetectionWe've covered a lot of ground in this series: Windows Security events for logon tracking and process execution; PowerShell…