Governance Risk Compliance

Appropriately managing an organisation's Information Security Risk requires the selection and deployment of appropriate controls in the context of the risk attitude and culture of your business.

Mitigation measures or controls should work cohesively, taking account of cross-functional business requirements to create a system of integrated controls, technologies and processes, all implemented, monitored and managed to maintain effectiveness. The controls and risk mitigation activities selected may need to address specific requirements to meet financial, operational, legal, compliance and business risk obligations.

With over 20 years of experience, commissum is adept at offering practical advice and recommending cost-effective solutions, to deliver a joined-up, coherent approach to protecting an organisation's information assets.

Whether it involves the traditional approach of measuring an organisation against best practice using an ISO27001 Gap Analysis, formal assessments against government frameworks such as the HMG Security Policy Framework (SPF), or a more radical review focused on cost optimisation, commissum has a track record that holds its own with the best.

Many organisations, faced with the challenge of getting to grips with information security risks choose to adopt best practice and perhaps certify to the ISO27001 Code of Practice for Information Security Management (indeed, commissum would usually recommend doing so). This ISO standard sets out, in practical terms, how the implementation of an Information Security Management System (ISMS) can enable information risk to be managed to a level acceptable to the business. In essence it states that an effective ISMS will have the following characteristics:

• Executive support.
• Embedded into the organisational culture.
• Business risk-driven and proactive.
• Aligned to a strategic framework.
• Delivering legal and regulatory compliance.
• Set into a robust policy environment.
• Supported by active training and awareness.
• Solid technical controls.

commissum fully endorses such an approach and works with organisations to maximise the benefits that arise, while minimising the costs of implementation.

• Cyber Security Strategy
• ISO 27001/2 Gap Analysis
• CLAS
• Security Health Check
• Security Audit
• ISO 27001 transition
• PCI DSS
• Secure Software Development
• Business Continuity Consulting
• Education
  • Corporate Security Awareness
  • Seminars