Phases to implement ISO 27001

Stage 1: Implementation of the ISMS

In this phase, the company must focus on the development and implementation of an effective medium and long-term plan that avoids or mitigates possible risks to information security. The training and information of the company’s personnel will also begin, so as to guarantee the correct implementation of the ISMS. The support of a consultant is usually common.

Stage 2: Certification of the ISO 27001:2007 Standard

When the company considers that its implementation is ready to pass the audit, the certification entity, such as EQA, verifies that the company meets all the requirements of the ISO 27001:2007 standard.

An EQA auditor, an expert in the company’s sector, reviews the operation of the company. If the auditor observes differences, these must be corrected by the company before the certification entity can issue the certificate.

Management systems, once certified, must undergo an annual review and undergo a renewal audit in the third year.

Contact us for more information about ISO 27001