Beyond Templates

Beyond Templates: Tailored ISMS Solutions For Effective Information Security Management

Providing technical and professional support services to professional partnerships and limited liability partnerships, this small company (160 employees) needed to transition from an information security management system (ISMS) with unused documentation and critical missing components to a fully-compliant ISMS.

Challenge

Despite obtaining certification through a previous consulting firm, the company faced significant challenges due a disconnect between their information security management system and their daily information security activities.

They paid their consulting company for a set of document templates and consulting services to complete them, but found these generic templates bore little resemblance to the actual information security activities of the organization, resulting in critical components missing from their ISMS.

Moreover, the ISMS documentation served more as a rushed "documentation exercise" prior to their first surveillance audit rather than a practical tool for their security and technology teams, rendering it largely unused.

Solution

JBW Group International closely worked with the company to implement an ISO 27001 information security management system (ISMS) for the organization tailored to their needs.

This involved identifying and documenting information security objectives and security-related activities directly applicable to the enterprise. Actual risk assessment activities were formally captured and security policies were updated to accurately reflect the nature of the business.

Generic legal and regulatory “requirements” were replaced with an actual assessment and impact analysis which was submitted to General Counsel for review and approval. Superfluous documentation and meaningless metrics were dropped in favor of measurements that provide insights into managing risk for the organization.

Results

  • Substantial reduction in IT department workload due to elimination of template documentation in favor of capturing actual security and technology activities.
  • Implementation of a continual assessment strategy enhanced risk management and technology practices, ensuring ongoing alignment with evolving security needs.
  • Successful and cost-effective transition to the latest version of ISO 27001, leveraging existing efforts from the previous ISMS implementation.

Download pdf

How Can We Help?

Our advisory, consulting and second-party audit services are tailored to each company we serve.

Let's Talk

  • Trust
  • Plain Dealing
  • Tailored Services
  • Safety First
  • Attention to Details