Internal and external audit (ISO 27001)
An ISO 27001 internal audit is a review an organization performs on its own ISMS (information security management system), using staff or a third party independent of the audited area, to verify it conforms to the standard, as clause 9.2 requires. An external audit is performed by a certification body to grant or maintain certification. Both assess the management system, not only technical controls.
How TecnetOne handles it: TecnetGRC
ISO 27001 internal audit, ISO 27001 external audit, certification audit, surveillance audit, ISO 27001 internal auditor
Related terms
ISO 42001
ISO/IEC 42001:2023 is the international standard that sets the requirements for an artificial intelligence (AI) management system: policies, risk and impact assessment, controls and continual improvement for developing, providing or using AI responsibly. It is certifiable and follows the same high-level structure as ISO 27001, so it can be integrated into an existing security management system.
Risk treatment
Risk treatment is the stage of risk management in which an organization decides what to do with each assessed risk: mitigate it with controls, avoid it by stopping the activity, transfer it, for example through cyber insurance, or accept it. In ISO 27001 these decisions are documented in a risk treatment plan. Risk appetite sets the acceptable level; treatment is the decision about each risk.
Cybersecurity maturity model
A cybersecurity maturity model is a scale that measures how established, documented and continuously improved an organization's security practices are, usually in levels that range from informal processes to measured and optimized ones. A maturity assessment shows where the company stands, compares it with a reference framework and helps prioritize the next step.
Statement of Applicability (SoA)
A Statement of Applicability (SoA) is the mandatory ISO/IEC 27001 document that lists the Annex A controls, states which ones the organization applies and justifies the inclusion or exclusion of each. It is one of the first documents a certification auditor reviews, because it links the risk assessment to the controls actually implemented.
Virtual CISO (vCISO)
A virtual CISO (vCISO) is a service in which an outside specialist takes on the duties of a chief information security officer (CISO) on an hourly or subscription basis: strategy, policies, risk management and reporting to leadership. It is common in midsize companies that need that leadership for an audit or a customer requirement but cannot justify a full-time hire.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.