Governance, Risk and Compliance

• Understand the core and supporting business functions
• Understand and discuss the information security requirements of the organization in-line with the amended scope
• Review the network and security architecture
• Review the Data Center Design and perform the data center audit
• Review the physical and environmental security controls
• Perform the ISMS Internal Audit
• Discuss the Internal Audit Findings with the ISMS Coordinator and other personnel
• Assist in preparing the Audit Response Plan (Corrective and Preventive Action Reports)

• Provide Business Objectives
• Provide information on Critical business, IT and Quality Processes
• Provide the existing Quality Management System (QMS) documents
• Provide the existing security processes and related documentation

• Internal Audit Report
• Corrective and Preventive Action Reports
• Review report for the Security Architecture of the Network

• As per the requirement.

• Assist in preparing the Information Risk Management Reports (including Risk identification, analysis, rating and working on mitigation options)
• Perform the Vulnerability Assessment and Penetration Testing (on selected devices, IPs, as per the mutual agreement)
• Drafting the necessary Information Security Policies, Processes, Procedures and Standards

• Accountability of the enforcement and compliance with the laid down policies and standards remains with the client.

• Information Security Policies, Processes, Procedures and Standards

• As per the requirement.

• Review the maturity of information security within the organization in terms of management and technical requirements.
• Review the policies, procedures and standards, and advise on in its effectiveness, completeness and compliance to the accepted standards.

• Accountability of the enforcement and compliance with the laid out policies and standards remains with the client

• Reports, advisory and recommendations

• As per the requirement.

• Understand the core and supporting business functions
• Understand and discuss the information security requirements of the organization
• Finalize on the ISMS Scope
• Review the network and security architecture
• Review the physical and environmental security controls
• Review the existing documents like policies, procedures, forms etc. related to ISMS, certifications achieved by the organization like ISO9000, etc.
• Perform ‘As-Is’ analysis of the security schema (Current State Assessment)

 Execute

• Conduct the ISMS Implementation Training for key implementation personnel
• Assist in performing audits on Asset Inventory (based on Confidentiality, Integrity, Availability)
• Assist in preparing the Information Risk Management report (including Risk identification, analysis, rating and working on mitigation options)
• Perform Vulnerability Assessment and Penetration Testing (on selected devices, IPs, as per mutual agreement)
• Drafting necessary Information Security Policies
• Assist in drafting information security procedures, as required, including listing out the relevant formats
• Prepare the ISMS Implementation plan with ISMS Coordinator
• Assist in implementation of various policies and technical controls
• Conduct Information Security Trainings for different level of personnel in the organization (like Senior management and Business Managers, IT Teams, End-users and Auditors)

Check

• Perform ISMS Internal Audit
• Discuss Internal Audit Findings with ISMS Coordinator and other personnel, as required
• Assist in preparing Audit Response Plan (Corrective and Preventive Action Reports)

Act

• Assist in implementation of Audit Response Plan (Corrective and Preventive Action Reports)

• Management commitment for implementation of ISMS
• Hiring external certifying authority for obtaining certification

• Provide the Gap Analysis Report that includes a broad roadmap for ISMS
• Review report for Security Architecture for Network
• Finalized Information Security Scope Document
• Information Asset Register with Risk Management
• Information Security Policies, Procedures, Guidelines, Templates etc.
• Vulnerability Assessment and Penetration Test Reports
• ISMS Training Material
• Internal Audit Report
• Reports that list out the Corrective and Preventive Actions

• As per the requirement

• Business Scoping
• Gap Analysis
• Preparation of Reports
• Application Security Code Review
• Application Penetration Testing
• External Network-layer Penetration Tests
• Internal network Vulnerability Assessment

• Management would be responsible for the implementation of ISMS
• Hiring an external certifying authority to obtain certifications

• Self-Assessment Questionnaire (Duly Filled up SAQ)
• As-Is or Gap Analysis Report including a broad roadmap for PCI-DSS data security standards
• Review report for the Security Architecture for Networks
• Vulnerability Assessment and Penetration Test Reports
• Corrective and Preventive Action Reports

• As per the requirement.