Skip to content
RE:ORDER

ISMS in line with ISO/IEC 27001

We design an information security management system (ISMS) that meets ISO/IEC 27001 and support you in implementing it: from risk analysis to procedures that fit the way your organisation actually works. We finish with an internal audit and training, so the system is used, not just signed off.

Let's talk

When you need an ISMS

Poland's National Cybersecurity System Act (KSC) requires an information security management system. Organisations covered from the day the amendment took effect have until 3 April 2027 to put one in place. An ISMS in line with ISO/IEC 27001 may also be a tender requirement, a condition set by business partners or the first step towards certification.

01

What implementation covers

  • Policy and documentation

    An information security policy with supporting documentation that fits your structure and ways of working.

    • Security policy
    • Documentation

  • Assets and risk

    An inventory of information assets, a risk analysis with a risk treatment plan and a Statement of Applicability (SoA) for the Annex A controls.

    • Risk analysis
    • SoA
    • Annex A

  • Operating procedures

    Incident management, access control, backups, supplier management, and physical and environmental security.

    • Incidents
    • Access
    • Backups

  • Business continuity

    Business continuity and disaster recovery plans for key processes and systems.

    • Continuity plan
    • Recovery plan

  • Internal audit and training

    An internal audit of the system and training for staff and management. At the end, the system is ready to use and ready for the certification audit.

    • Internal audit
    • Training
    • Certification

02

Implementation outcome

A system ready to use and ready for the certification audit. We agree the acceptance criteria at the start.

Completeness
the documentation covers the requirements of the standard and the Annex A controls
Use
procedures work in everyday practice, as confirmed by the internal audit
Readiness
the internal audit result and a list of actions before certification

Certificates are issued by an independent certification body. We prepare your organisation for the certification audit, but we do not guarantee its result.

03

Selected work

  • ISMS documentation, implementation, internal audits and maintenance in line with ISO/IEC 27001 in district heating, public administration, transport and services, including transition to the 2023 edition of the standard.
  • Business continuity management systems, tested by shutting down the IT environment.
  • 30 organisations where we have implemented, audited or overseen cybersecurity and data protection.

04

Contact

Describe your situation. Within two working days we will tell you where to start, what scope of work we suggest and how long it will take.

Let's talkMeet the team

Related areas