Certification Consulting — ISO 27001, ISMS, ISMS-P
Helping organizations prepare for ISO 27001 and Korean ISMS/ISMS-P certification audits.
From certification preparation to ongoing security management
We support preparation for ISO/IEC 27001 and Korea’s ISMS and ISMS-P certifications. We review the services in scope and your readiness to define work on management systems, risk assessment, operational evidence and audit preparation.
We help put the updated policies and procedures into practice. Support for surveillance and recertification audits is agreed according to your operating conditions and engagement scope.
Core services
We cover international standards and Korean statutory requirements, from initial certification to ongoing maintenance.
ISO/IEC 27001:2022 certification consulting
Build an information security management system (ISMS) based on the 93 Annex A controls
- Align information security policies and controls with ISO/IEC 27001:2022
- Meet international security requirements for global business and enterprise partners
- Support Stage 1 document review, Stage 2 on-site assessment and corrective actions
Korean ISMS certification consulting
Support mandatory and voluntary certification under Korea's Network Act
- Address 16 management system requirements and 64 security control requirements
- Map each certification requirement and prevent potential findings
- Support applications to KISA or accredited certification bodies, document reviews and on-site assessments
Korean ISMS-P certification consulting
Certification preparation covering information security and personal information protection management
- Review personal information flows through collection, use, storage and disposal, and assess existing safeguards
- Define preparation tasks for the services and personal information processing within the certification scope
- Support management system establishment, operational evidence preparation and audit readiness
Risk assessment and mock audits
Identify and resolve potential findings through mock audits using auditor assessment criteria
- Identify information assets, assess asset value and determine the acceptable level of risk (DoA)
- Develop a risk treatment plan (RTP) and verify controls by priority
- Conduct a mock audit following the formal assessment process and report findings
Surveillance and certification maintenance
Prepare for annual surveillance and three-year recertification after initial certification
- Organize the ongoing collection and management of security operations evidence
- Update internal policies as laws, business scope and cloud environments change
- Provide recurring advice on surveillance assessments and certification maintenance
Certification process
Work progresses from reviewing the current state to improving the management system and preparing for the audit.
01
Define scope and analyze gaps
Define the services and infrastructure in scope, then identify gaps in policies, controls and operational evidence against the agreed criteria.
02
Establish and operate the management system
Update policies and procedures, assess risks, implement controls in daily operations and systematically collect required evidence.
03
Mock audit and certification assessment
Use mock audits to identify improvements, and support the certification audit and corrective action reporting within the agreed scope.
Frequently asked questions
Do you support preparation for both ISMS and ISMS-P?
We support preparation for Korea’s ISMS and ISMS-P certifications and ISO/IEC 27001. The preparation scope is established from the services and personal data processing activities in scope.
Where does initial certification preparation begin?
We define the services and infrastructure in scope and review gaps between current policies, controls, operational evidence and certification requirements. This establishes preparation tasks and their sequence.
What should we prepare for an initial discussion?
Please outline the intended certification, target services and systems, available policies and operational evidence, and your preferred schedule. Scope and timing are established after reviewing your readiness.
Is support available after certification?
We also provide advice for surveillance and recertification audit preparation. Support activities and duration are defined within the scope of the relevant engagement.
The scope of work and deliverables are determined by the target environment and the agreed engagement.
Prepare for certification with experienced consultants
We tailor the preparation roadmap to your industry and services. Contact us to discuss mock audits and assessment schedules.