➢ Kick-off meeting: A kick-off meeting will be held to initiate the project and align on objectives.

➢ Define ISMS scope and boundaries: The scope and boundaries of the Information Security Management System (ISMS) will be clearly defined with he help of the clients’ inputs.

➢ Project steering committee: A project steering committee will be established to oversee the project’s progress and decision-making.

➢ Roles, responsibilities, and authorities: Roles, responsibilities, and authorities for team members will be outlined to ensure clear accountability and effective management.

➢ Project timeframes: We will provide a Project timeframe which’ll be outlining the scheduled duration for completing various phases of the project.

➢ Project plan:  A Project plan will shared, detailing the overall strategy and steps needed to achieve the project’s objectives.

➢ Approach, methodology: INFOCUS IT’s Approach and methodology will define the strategies and techniques used to tackle project tasks and challenges.

➢ Introductory workshop: A virtual Introductory workshop would be conducted for an initial overview and orientation to set the stage for the project’s execution.

➢ Gap Analysis: Gap Analysis would help in identifying discrepancies between current practices and desired standards or requirements in the organization.

➢ Review of existing policies: This will help in evaluating current policies to determine their alignment with required standards and best practices.

➢ Gap analysis report: We’ll provide a detailed account of the identified gaps, including recommendations for bridging or clients to achieve compliance.

➢ Information asset inventory: This will help in establishing a comprehensive list of all information assets, detailing their types, locations, and owners of the organization.

➢ Information asset management framework: We will provide a structured approach for managing and protecting information assets throughout their lifecycle, ensuring they are appropriately secured and utilized.

➢ Asset registers: INFOCUS IT will provide you with a detailed records of information assets, including their classification, value, and risk level, to support effective management and protection.

➢ Risk Assessment methodology: Our risk assessment methodology outlines the approach used to identify, analyze, and evaluate risks within the organization.

➢ Criteria for risk treatment and acceptance: Criteria for risk treatment and acceptance would be defined on the basis of the standards.

➢ Risk assessment framework: INFOCUS IT’s risk assessment framework provides the structured process and tools for conducting risk assessments and ensuring comprehensive risk management.

➢ Identification and evaluation for risk treatment plans: Identification and evaluation for risk treatment plans involves determining the necessary actions to address and mitigate risks, followed by evaluating the effectiveness of these plans.

➢ Selection of control objectives and controls: We help in determining the specific goals and security measures needed to mitigate identified risks and ensure compliance with risk management requirements.

➢ Risk Assessment Report: INFOCUS IT provides the Risk Assessment Report which includes the findings from the risk assessment process, including identified risks, their potential impacts, and the proposed risk treatment strategies.

➢ Control objectives & controls: Outline the specific goals for protecting information and the measures implemented to achieve them.

➢ Documentation of identified Risk: Detail the risks that have been identified and documented, including their potential impact and the strategies to address them.

➢ Statement of Applicability (SOA): Define how the principles of confidentiality, integrity, and availability are applied, ensuring that sensitive information remains protected, accurate, and accessible as required.

➢ Review /Design existing policies and procedures: Evaluating and refining current policies and procedures to ensure they meet the necessary standards and requirements.

➢ Design of policies, procedures, and guidelines: We create new policies, procedures, and guidelines to address identified needs and enhance organizational practices.

➢ Submission of Documents for review & approval: Present the developed policies and procedures to relevant stakeholders for review and formal approval.

➢ Training sessions: Offer a comprehensive overview of essential topics, ensuring participants are well-versed in key concepts and practices.

➢ ISO basics: Cover fundamental principles and standards of ISO 27001, providing a solid foundation for understanding information security management.

➢ Risk Assessment: Equip participants with the basic knowledge to identify, evaluate, and prioritize risks to effectively manage and mitigate potential threats.

➢ Internal Audit: Teach the processes and techniques for conducting thorough internal audits to assess compliance and effectiveness of information security controls.

➢ Audit checklist preparation: Development of detailed checklists to ensure all relevant aspects of the ISO 27001 standard are covered during audits.

➢ Audit report writing: Crafting clear, comprehensive, and actionable audit reports that communicate findings and recommendations effectively.

➢ Internal audits (IT, Operations, Legal, Finance): Internal audits are conducted across various departments including IT, Operations, Legal, and Finance to evaluate the effectiveness of controls and compliance with established policies and regulations.

➢ Internal Audit report: The audit report provides a comprehensive assessment of the audit findings, highlighting areas of strength, identifying weaknesses, and recommending improvements to ensure robust governance and risk management.

➢ Management review meetings: Evaluate the effectiveness and alignment of the Information Security Management System (ISMS) with organizational goals and policies.

➢ Corrective action plan: Develop and implement strategies to address identified issues or non-conformities within the ISMS.

➢ Review of implemented controls: Assess the effectiveness and efficiency of security controls that have been put in place to protect information assets.

➢ Continual Improvement plan: Identify and implement opportunities for enhancing the ISMS to better manage and mitigate information security risks.

➢ Review of ISMS Dashboard: Monitor and analyze key metrics and performance indicators related to the ISMS to ensure it meets its objectives and supports overall security strategy.

➢ Readiness checks for final (External) audit: Conduct thorough checks to confirm fully preparedness for the final audit by an external body.

➢ Stage1 Audit: Perform a preliminary audit to assess your initial compliance and identify any areas that require improvement before the main audit.

➢ Stage 2 Audit: Execute the main audit to verify the implementation and effectiveness of your information security management system.

➢ Closure of Gaps given by External Body: Address and resolve any issues or gaps identified by the external audit to ensure successful certification.

➢ ISO27001:2022 Certified: Achieve certification under ISO 27001:2022, demonstrating your commitment to robust information security management

➢ Start again from stage: This involves reviewing the ISO 27001 ISMS again from the initial stage of the audit process, including a reassessment of the scope, objectives, and key areas of focus to ensure ongoing compliance and effectiveness.