ISO/IEC 27001 ISMS Initial Readiness Assessment

You don't need a certification audit when you are still working out where you stand.

The assessment is specifically intended for organizations at an early stage of developing an ISMS. Rather than expecting full compliance, it looks at your actual environment, including existing, informal and partially documented practices that could become part of the future ISMS.

• Understand - Establish realistic  picture of your current ISMS readiness.
• Build on what you have - Identify existing practices and capabilities that cat support your future ISMS
• Prioritize - Identify significant gaps and establish practical priorities for further development.

1. Introduction & Awareness - We introduce the assessment, provide a high-level ISMS overview and help relevant stakeholders understand how to approach the readiness questionnaire. (Consultant effort: 0.5 day)
2. Internal Self-Assessment - Your organization completes our structured ISMS Readiness Questionnaire, reflecting the actual current situation, including informal 
3. Consultant Review - We review the responses to identify existing capabilities, significant gaps, inconsistencies and areas that require further discussion. (Consultant effort: 0.5 day)
4. Clarification Workshops - Focused discussions with relevant stakeholders help validate our understanding, explore cross-functional dependencies and establish initial priorities. (Two half-day workshops)
5. Readiness Report & Action Plan - We consolidate the findings into a concise assessment covering existing capabilities, key gaps, prioritized recommendations and a practical initial action plan.(Consultant effort: 1 day)
6. Results & Next Steps - We present the findings to your stakeholders and discuss priorities and recommended next steps.

• Clear findings. Practical next steps.
• ISMS Readiness Questionnaire - A structured starting point for understanding your organization's current practices.
• Initial Readiness Assessment Report - A concise view of your existing capabilities, significant gaps and overall readiness observations.
• Prioritized Action Plan - Clear priorities for progressing the development of your ISMS.
• Results Presentation - Presentation and discussion of findings, recommendations and recommended next steps.

An ISMS is not just an IT project.

Effective information security requires involvement across the organization. The assessment is designed to involve appropriate stakeholders from IT, HR, Legal, Compliance, Executive Management and other relevant functions, helping establish awareness and ownership from the beginning.

IT • HR • Legal • Compliance • Management

The engagement is deliberately designed as a lightweight initial assessment, with a maximum of 3 consultancy days. It gives management useful insight and direction without beginning with an unnecessarily extensive consulting exercise.

(the three-day allocation refers to consultant effort rather than elapsed calendar time)

 This is:

• An initial ISO/IEC 27001 readiness assessment
• A structured current-state review
• A way to identify existing strengths and significant gaps
• An awareness-building exercise
• A starting point for an ISMS development plan

This is not:

• A certification audit
• A formal ISO/IEC 27001 internal audit
• A penetration or vulnerability test
• A detailed information security risk assessment
• Complete ISMS implementation
• A guarantee of ISO/IEC 27001 certification

Your organization will have:

• A clearer understanding of readiness
  Know your current position on the ISO 27001 journey.
• Visibility of what already works
  Recognize existing practices you can leverage rather than unnecessarily starting again.
• Clear priorities
  Understand the significant gaps and where attention is needed first.
• Greater organizational awareness
  Help relevant business functions understand their role in the ISMS.
• A practical starting plan
  Leave with prioritized initial actions for progressing the ISMS.