ISO 27001 implementation

Why PwC for your ISO 27001 implementation?

Knowing that complexity is the enemy of security, PwC offers advice to help you and your organisation with the implementation of a pragmatic Information Security Management System (ISMS) that’s tailored to your organisation’s context, size and culture. We'll guide you through the entire process of implementing (or optimising) an ISMS to ensure that it is truly embedded within the organisation. Our approach also allows organisations to incrementally increase the scope of their ISMS as the added value of the system becomes clear throughout the organisation ("Think Big, Start Small").

Our value proposition:

• Efficiency: We've built an extensive toolbox consisting of all the mandatory documents and supporting tools that we can leverage, shape and adapt to your organisation to go through the implementation process in an effective and efficient way. We'll also align our tools and deliverables with available information security policies, standards, procedures and ways of working within your organisation in order to reduce the impact of organisational change.

• Experienced and certified team: We offer an experienced and certified team (ISO 27001 Lead Implementer and Lead Auditor) that’s performed multiple successful ISMS implementations in the past, backed by a local team of over 50 security professionals and a global network, to provide specific expertise, ready to assist you with the implementation of any missing security controls. Our many years (10+) of experience in auditing information security management systems allows us to think as an auditor, which we can leverage during the implementation to anticipate the official certification auditor.

• Accommodate your budget: We offer our service in different packages to adapt our level of assistance to your available budget and internal resources. As such, we can take the lead during the entire process, share the workload with your team or simply advise you during the implementation process with guidance, reference materials and performing quality assurance.

• Integrated Management System: ISO management systems exist for many different areas, including information security (ISO 27001), business continuity (ISO 22301), privacy (27701), quality (ISO 9001) and more. They all have certain practices in common that are specific to management systems. We have the internal capacity and knowledge to implement and merge all aforementioned management systems into a single integrated management system for efficiency gains.

• Use of open standards: Instead of using proprietary security standards for the risk assessment and control implementation, we use publicly available standards and best practices that are industry and regulatory recognised. Our variety of in-house knowledge and expertise allows us to conduct technical risk assessments based on open standards (ISO 27002, NIST, CIS CSC Top 20, etc.) and experience, resulting in actionable security measures.