Overview
Regulators expect licensees to manage information security as a system, not as a set of one-off tests. Most require evidence of an information security management system, commonly aligned with ISO/IEC 27001.
We audit your ISMS against ISO/IEC 27001 and the regulator's own security requirements, and report the gaps with a practical plan to close them.
What we test
- Information security policy and risk assessment
- Access control, identity and privileged accounts
- Operations security, logging and monitoring
- Supplier and cloud hosting controls
- Incident management and business continuity
- Physical security of data centres and offices
What you submit
- ISMS documentation and risk register
- Statement of applicability
- Access to key staff and evidence
What you receive
- ISMS audit report
- Gap analysis against ISO/IEC 27001
- Remediation plan
Timeline and pricing
Both depend on the scope of the product and the number of markets. We agree a fixed quote and a timeline at scoping, before any work starts, and you can follow progress throughout.