Information Security Management System (ISMS) Assessments
Evaluate the design, implementation, and continual improvement of your Information Security Management System (ISMS) against ISO/IEC 27001:2022 requirements.
What We Examine
An effective Information Security Management System (ISMS) is more than a binder of policies—it is an operational management system that systematically identifies information risks, applies Annex A controls, measures performance, and drives continual improvement.
Elegant Infosec conducts rigorous ISMS Assessments for organizations preparing for initial ISO/IEC 27001 certification, transitioning to the 2022 standard revision, or fulfilling Clause 9.2 requirements for an objective, independent internal ISMS audit. We evaluate both management clauses (Clauses 4 through 10) and technical/organizational controls across Annex A.
Why Organizations Engage Us
Preparing for external certification audits
Entering a Stage 1 or Stage 2 certification audit with unaddressed major non-conformities delays certification timelines and impacts commercial commitments.
Fulfilling Clause 9.2 internal audit independence
ISO/IEC 27001 requires internal audits at planned intervals conducted by personnel objective and impartial to the processes being audited.
Transitioning and maintaining Annex A controls
Ensuring that threat intelligence, cloud service usage, data masking, configuration management, and secure coding controls under ISO/IEC 27001:2022 are backed by real evidence.
Linking Risk Assessment to the Statement of Applicability
Audit findings frequently arise when an organization’s risk assessment, risk treatment plan, and Statement of Applicability (SoA) are not logically connected.
Technical Boundaries & Control Layers
ISMS Management Clauses (Clauses 4–10)
- Context of the organization, interested parties, and ISMS scope boundaries (Clause 4)
- Leadership commitment, security roles, and risk assessment/treatment methodology (Clauses 5 & 6)
- Competence, awareness, documented information control, and operational planning (Clauses 7 & 8)
- Performance evaluation, internal audit records, management review, and corrective actions (Clauses 9 & 10)
Organizational & People Controls (Annex A.5 & A.6)
- Policies for information security, threat intelligence, and supplier relationships
- Asset inventory, acceptable use, information classification, and access control rules
- Background screening, confidentiality obligations, security awareness, and remote working
Physical & Technological Controls (Annex A.7 & A.8)
- Physical security perimeters, equipment protection, and secure disposal
- User endpoint devices, privileged access rights, cryptography, and secure configuration
- Vulnerability management, logging/monitoring, network security, and secure SDLC
Examination Protocol
Evaluate management system design (Stage 1 equivalent)
Inspect the ISMS scope statement, information security policy, risk assessment methodology, risk treatment plan, and Statement of Applicability (SoA).
Verify control implementation across departments (Stage 2 equivalent)
Conduct structured interviews and sample operational records across IT, Engineering, HR, Facilities, Legal/Procurement, and Leadership.
Categorize findings using standard audit grading
Classify gaps into Major Non-Conformities, Minor Non-Conformities, Observations, and Opportunities for Improvement (OFIs) with exact clause references.
Guide root-cause analysis and closure verification
Provide structured audit reports for Clause 9.3 Management Review and verify corrective action plans prior to external registrar audits.
Evidence & Reporting Outputs
Formal ISMS Internal Audit / Readiness Report
Clause-by-clause (4–10) and Annex A (A.5–A.8) assessment report documenting conformity status, inspected evidence, and graded findings.
Non-Conformity & Corrective Action Register
Structured tracker for documenting root-cause analysis, corrective actions, control owners, and closure verification.
Statement of Applicability (SoA) & Risk Alignment Review
Focused critique of your SoA justifications, exclusions, and alignment with the organizational risk register.
Referenced Security Frameworks
Information security, cybersecurity and privacy protection — Information security management systems — Requirements.
Information security controls implementation guidance and guidelines for auditing management systems.
Extended control guidance for cloud service providers/customers and protection of PII in public clouds.
Common Procurement Questions
Is Elegant Infosec an accredited ISO 27001 certification body?
No. Elegant Infosec is an independent cybersecurity auditing and consultancy firm, not an accredited ISO registrar. We perform pre-certification readiness assessments, gap analyses, and independent internal ISMS audits (Clause 9.2), which prepares your organization for a smooth external certification audit by an accredited registrar.
Why outsource the ISO 27001 internal audit to an independent specialist?
Clause 9.2 requires objectivity and impartiality—meaning IT or security leaders cannot audit their own work. Engaging an independent specialist provides credible audit rigor, uncovers blind spots before the external registrar arrives, and reduces internal workload.
Can you audit multi-site or hybrid ISMS scopes?
Yes. We tailor our audit sampling plan to cover headquarters, regional offices, cloud environments, and remote engineering teams within your defined ISMS boundary.
Start your security assessment.
WHAT ARE YOU MISSING?
Tell us what you need assessed. We’ll help define the scope and next steps.