Audit and compliance
We assess security against the law of Kazakhstan and international standards. We show the gap between the requirements and the actual state and help close it before an inspection.
- A.5.15Access controlMet
- A.5.24Incident management planning and preparationPartial
- A.8.8Management of technical vulnerabilitiesPartial
- A.8.13Information backupMet
- A.8.16Monitoring activitiesNot met
A plan to close the gaps with owners and deadlines
Requirements
- Law of Kazakhstan
- The law on personal data and their protection, the law on informatization and the Unified Requirements for ICT and information security.
- ISO/IEC 27001
- Information security management system: assessment, documents, internal audit and preparation for the certification audit.
- PCI DSS
- Payment system requirements for companies that process card data.
- Industry requirements
- Requirements of financial market regulators and other industries, where they apply to you.
Photographs
Photos: Samuel Zeller, CC0; Lacz02, CC BY-SA 4.0; Hay Kranen, CC BY 4.0; Estormiz, CC0, Wikimedia Commons.
Formats
Audit
An independent assessment of the current state with a gap report.
Preparation
We write documents, implement controls and run an internal audit before the external one.
Ongoing support
We maintain compliance between audits: changes, training, an annual review.
How an audit goes
- 01
Scope
We define the requirements, systems and departments the audit covers.
- 02
Data collection
Interviews, document review, configuration checks and sample technical testing.
- 03
Gap analysis
We compare the actual state with the requirements clause by clause.
- 04
Plan
We propose measures for the gaps with a priority, an owner and a deadline.
- 05
Report
A report for management and working materials for the team.
What you get
- A compliance report by requirement clause.
- A plan to close the gaps.
- Documents: policies, procedures, a statement of applicability.
- Readiness for an external audit or a regulator’s inspection.
Questions
Ask your own questionDo you issue ISO/IEC 27001 certificates?
No. An accredited certification body issues the certificate. We prepare the company for its audit.
Where do we start if there are many requirements?
With a short assessment: it shows which requirements apply to you and where the biggest gaps are. We build the plan from it.
How long does ISO/IEC 27001 preparation take?
It depends on the size of the company and the maturity of its processes. We name the timeline after the initial assessment.
Discuss your task
Describe the task and the timeline. We will reply, clarify the scope and propose a plan.
- Contract. We start with a contract and a non-disclosure agreement. The scope of work and the permissions are put in writing.
- Scope. Goals, systems, timing and emergency contacts are agreed before the work starts.
- Work. We keep you updated as the work goes and report critical findings at once.
- Report. We hand over a management report and a technical report with evidence and recommendations.
Or write to us: info@dozorsecurity.kz