The information security management standard. The management system clauses set the discipline, and Annex A supplies the control set you select from and justify.
Information security, cybersecurity and privacy protection. Information security management systems. Requirements.
Organisations holding data somebody else cares about, usually driven by a customer requirement, a regulator, or the wish to answer security questionnaires once instead of forty times.
The clause numbers and titles above are the standard's own public structure. The standard itself is copyright of its issuing body and you buy it from them. What we add is the interpretation underneath, and that lives in your workspace.
This is the running work for this standard specifically. The general shape is the same across all of them.
Each one is filed against the requirement it satisfies as the work happens, so the pack for the next visit already exists.
The quality management standard most certified organisations start with, and the one most other management system standards borrow their structure from.
The continuity standard, built around one question: when the thing you deliver stops, how quickly does it come back, and who decided that was fast enough.
Not a certification but an attestation. An independent auditor reports on whether your controls were designed properly, and for Type II, whether they operated over a period.
The requirement, the control attached to it, the evidence that satisfies it, and the audit checklist it generates. Nothing prepared in advance, because there is nothing to prepare.
