Overview
This standard provides guidance on the information security aspects of cloud computing, recommending and assisting with the implementation of cloud-specific information security controls supplementing the guidance in ISO/IEC 27002 and other ISO27k standards.
It gives guidelines for information security controls applicable to the provision and use of cloud services by providing:
- Additional implementation guidance for relevant controls specified in ISO/IEC 27002
- Additional controls with implementation guidance that specifically relate to cloud services
This standard provides controls and implementation guidance for both cloud service providers and cloud service customers.
Phases of Consultancy
Know your Business Objective rather know you
- What you do?
- How do you do?
- What do you use?
- How much automation is involved?
- Strive to Map is with the standard requirement
Context & Risk assessment along with Gap Analysis
- Know your interested parties, internal and external issues
- Assess business risk and recommend treatment
- Roadmap to bridge the identified gaps
Define Management System (Reverse Engineering)
- Upgrade what you have
- Translate your business practices into compliance-speak with easy-to-use Process & templates
- A very slim set of policies, procedures, template and guideline
Training workshop
- InfoSec Awareness
- Risk Management
- Process Owner’s training
Performance Monitoring
- What is your pain area?
- Where do you expect improvement?
- Define Performance Objective
- Derive Performance
- Analyse Trend
Program Management
- Progress monitoring
- Status overview to Management
- Continuous Record review
- Facilitation to Process Owners
Internal Audit
- Internal Audit to ensure readiness
- NC closure and trend analysis
External Certification Support
- Identify right Certification partner
- Collaboration
- Guidance for NC closure (If any)
- Be there to Celebrate Success
Related Services
ISO 27001/ISO 27002 - Information Security (ISMS)
Ensuring Information Security is defined, implemented, measured and audited in products, services and processes, resulting in business protection and successful ISO 27001 certification
ISO 22301 - Business Continuity (BCMS)
Ensures that Business Continuity and Disaster recovery capability is defined, documented and tested So your organization has developed resiliency and improved risk management.
ISO 31000 - Enterprise Risk (ERM)
Helps organization develop a risk management strategy to effectively identify and mitigate risks, thereby enhancing the likelihood of achieving their objectives and increasing the protection of their assets.
ISO 9001 - Quality (QMS)
Effective & Controlled delivery management followed by ROI, customer satisfaction and First-time right implementation.
CISO/CIO – Chief Information Security Officer
A Virtual Chief Information Security Officer is an outsourced security advisor whose responsibilities varies depending upon your business needs.
InfoSec
Creating a culture of security means building security values into the fabric of your business. Training that covers situational awareness (why someone might be at risk), plus work and home-life benefits is a good way to bring people onboard.