ISO 27001: who does which part
ITF Consult builds the management system, and ITF Cyber supplies the security documents and work that sit inside it.
- Standard
- ISO/IEC 27001:2022, Annex A: 93 controls in four themes
- Owned by
- ITF Consult, as one project
- Cyber supplies
- Policies, incident plan, supplier assessments, test scopes, ECC mapping
- Delivery
- Remote, with on-site work in Saudi Arabia where needed
ISO/IEC 27001:2022 is a certifiable information security management system. ITF Consult builds it: scope, risk method, Statement of Applicability, internal audit and management review. ITF Cyber writes the security policies, the incident plan, the supplier assessments and the test scopes that the system's controls call for. Certification is by an accredited body you choose.
- 01 Call
- 02 Scope
- 03 Read
- 04 Register
- 05 Documents
- 06 Plan
ISO 27001: who does which part sits at step 5 of how an engagement runs. You receive the document set.
The split
A management system is mostly about decisions, records and review, which is Consult's daily work. The security controls inside it need someone who knows how the controls are attacked and what evidence a reviewer will ask for. One team for each, one document set, one project plan.
| Part of the ISMS | Who does it |
|---|---|
| Scope, context, interested parties | ITF Consult |
| Risk assessment method and treatment plan | ITF Consult |
| Statement of Applicability | ITF Consult |
| Security policies behind the Annex A controls | ITF Cyber, drafted into Consult's document control |
| Supplier security, incident management, secure development controls | ITF Cyber |
| Evidence for technical controls that need testing | ITF Cyber scopes the test; a testing provider tests |
| ECC-2:2024 mapping, if you are in Saudi Arabia | ITF Cyber, on the same register |
| Internal audit and management review | ITF Consult |
What Cyber hands into the project
The policy set with its Annex A mapping
Each policy tied to the Annex A controls it answers, with an owner and the record that proves it runs.
The supplier register and assessments
Suppliers tiered by what they touch, with an assessment record for each Tier 1 supplier.
The incident plan and exercise report
The plan, and the after-action report from its first tabletop exercise.
The test scope and fix plan
What the testing provider tests, and the findings turned into owners and dates.
A certificate asked for within the year
A logistics technology company is asked by a customer for ISO 27001 certification within the year.
Consult scopes the ISMS to the platform and the team that runs it, and builds the risk method and the Statement of Applicability. Cyber writes the policies the applicable controls need, builds the supplier register for the three cloud services the platform runs on, writes the incident plan and runs its first exercise, and scopes the application test.
The company runs the system and produces records. Before the certification audit, that means at least one internal audit and one management review, with the records to show them. You and your certification body set the pace.
Who to talk to
Do we buy this from Consult or from Cyber?
From ITF Consult, as one project. Cyber's part is inside it.
Will you recommend a certification body?
No. You choose one, and we do not act for any.
Can one project cover ISO 27001 and ECC?
Yes. One evidence set, mapped to both, with ECC's Saudi-specific controls flagged early.
Go further
ISO 27001 readiness, ITF Consult
The management system, the risk assessment and the Statement of Applicability, with ECC mapped.
Read moreServiceSecurity policies and governance
The policy set behind the Annex A controls, each paired with its record.
Read moreSaudi regulationNCA ECC readiness
ECC-2:2024 mapped on the same register as the ISMS.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
ISO 27001 starts on the Consult side
It runs as one ITF Consult project, with Cyber's security work inside it.