ISO 27001

ISO/IEC 27001:2022 specifies requirements for an information security management system. We help you assess risks, plan appropriate measures and develop the documentation your organisation needs.

Concept visualisation: Secure access to data centre infrastructure
gray-box

Minimizing Risk, Maximizing Effectiveness

An information security management system (ISMS) based on ISO/IEC 27001 embeds confidentiality, integrity and availability in your organisation's processes. It combines technical, organisational and personnel measures with systematic risk assessment.

The standard applies to organisations across sectors and of different sizes. High Knowledge supports baseline reviews, audit preparation and resolution of identified nonconformities. The assessment scope, certification procedure and responsible certification body are clarified before commissioning.

A certificate covers the defined scope of the ISMS. It is not blanket evidence of compliance with every legal requirement.

Ganzheitliche Betrachtung

Preventing unauthorized access, damage, and disruption to an organization’'s information and information processing facilities is a key objective for any ISO 27001- certified management system. During audits, we often find that there are gaps in the area of ​​physical security, especially in relation to Data Centers and the associated IT infrastructure. 

None of the checks mentioned in ISO 27001 work in isolation. For this reason, we want to ensure during the assessment that there is a set of interrelated processes that enable effective and sustainable resource protection.

gold-outline

ISO 27001 based on IT-Grundschutz and the BSI IT-Grundschutz Compendium

ISO/IEC 27001 certification based on IT-Grundschutz combines ISMS requirements with the German BSI's IT-Grundschutz methodology. BSI Standards 200-1, 200-2 and 200-3 and the IT-Grundschutz Compendium support systematic development and operation of the management system.

This procedure differs from direct ISO/IEC 27001 certification. We clarify the appropriate assessment route, the information domain and evidence requirements with you. Your business processes and defined scope provide the foundation.

Concept visualisation: Audit of data centre infrastructure
gray-box
bsi-logo

Procedure for obtaining ISO 27001 certification

1. Gap Analysis / Pre-Audit

This activity, performed by our auditors, offers the opportunity to focus on critical, high-risk, or weak areas in your system to create a certifiable system. We also check to what extent existing management systems or processes, for example based on ISO 13485 or ISO 9001, can be used within the standard you have selected.


Wherever you are in the certification process, you determine the scope.

2. Certification

This is usually a two-phase process consisting of an assessment of the system and an initial assessment. The duration depends on the size and type of your organization.

3. Monitoring

Once we have validated your ISMS, we conduct regular audits to ensure the ongoing effectiveness of your system. As a result, you can be sure that your ISMS is able to preventively ensure information security and to protect the information and data of your organizations from damage and threats.

4. Management system assessment

If you wish to combine your company’'s ISMS with an existing management system (e.g., quality), you could benefit from a coordinated assessment and monitoring program.

Our range of ISO 27001 audit and training services is suitable for companies and organizations of all sizes. Do you have questions about ISO 27001? 

Contact us!