Risk assessment
Assesses where information lives and what risks it faces
Services
Security rules your people can follow
An Information Security Management System is a set of approved policies that say who may do what with your data, and how you know they did.
groupsFor Anyone handling other people's data
policy
ISMS PoliciesA written policy set, aligned to ISO/IEC 27001, that your own people can follow.
- 1Scope
- 2Risk assessment
- 3Policies and controls
- 4Roll-out and review
ISO/IEC 27001Aligned to
Plain languagePolicies staff read
Reviewed annuallyKept alive
What it is
Rules people actually read.
ISMS policies are the approved rules that govern information security in an organisation, aligned to standards such as ISO/IEC 27001. Written well, they are short, specific and actually read by the people they apply to.
policy
In short
A written policy set, aligned to ISO/IEC 27001, that your own people can follow.
What AVGN does
Five parts of the policy set.
Policy writing
Writes the policy set: access, backup, incident response, remote work
Control mapping
Maps each policy to the ISO/IEC 27001 controls it satisfies
Supporting records
Prepares supporting records: asset register, risk register
Training & review
Trains staff in plain language and reviews annually
How it works
Four steps to a policy set.
- STEP 1Scope
Which locations, systems and data the ISMS covers, and why.
- STEP 2Risk assessment
What could go wrong, how likely, how bad, and what already reduces it.
- STEP 3Policies and controls
Drafted with your management, reviewed, approved and dated.
- STEP 4Roll-out and review
Staff briefed, technical settings aligned, reviewed annually or after an incident.
lightbulb
Example. A pharmaceutical distributor is asked by a multinational principal to show its information-security policies before a contract renewal. In three weeks we assess the two offices and the warehouse, write nine policies with a risk register and an asset register, brief the 35 staff in one session, and tighten access on the ERP so that the policy and the system say the same thing. The principal's questionnaire is answered directly from the policy set.
Who it’s for
For audits, tenders & vendor checks.
Organisations that handle other people's data or are asked to prove they protect their own, ahead of a vendor assessment, an audit or a tender.
FAQs
Questions about ISMS.
Does this make us ISO/IEC 27001 certified? expand_more
No. Certification is issued by an accredited body after its own audit. Our policies and records are aligned to the standard and prepare you for that audit.
We are a small company. Do we really need this? expand_more
If a customer, auditor or regulator can ask how you protect data, yes. The policy set scales down; a 30-person company needs a few pages, not a binder.
Everything we do
All our services, one team
24×7×365 IT SupportAMC — Comprehensive & Non-ComprehensiveAdvanced Secured NetworkingCloud SolutionsData Backup SolutionsData Security SolutionsFirewall & VPN SolutionsISMS PoliciesIT Infrastructure ConsultingIT Infrastructure Planning, Design & ImplementationManaged IT ServicesVirtualization SolutionsWeb & Email HostingWireless NetworkingLaptops on RentServers on RentCCTV & Camera ServicesComputer & Laptop RepairWebsite & Software Development Services
IT Infrastructure Planning, Design & ImplementationManaged IT ServicesVirtualization SolutionsWeb & Email HostingWireless NetworkingLaptops on RentServers on RentCCTV & Camera ServicesComputer & Laptop RepairWebsite & Software Development Services24×7×365 IT SupportAMC — Comprehensive & Non-ComprehensiveAdvanced Secured NetworkingCloud SolutionsData Backup SolutionsData Security SolutionsFirewall & VPN SolutionsISMS PoliciesIT Infrastructure Consulting
Been asked for your security policies? Send us the questionnaire and we will tell you what is missing.
We come back within one working day with a clear next step.