Skip to content

Information Security and ISO Compliance

Information Security and ISO Compliance

Information Security and ISO Compliance Projects

I treat information security as part of the process, not as a separate step after development. In 2025 I completed intensive training in this field and I run projects aligned with ISO management-system principles.

Who this is for

This is for organizations that must set up a management system such as ISO 27001 or ISO 42001 because of a customer or regulatory requirement, but do not know how to plan scope and effort. We start by drawing a realistic scope and then break the work into small steps.

What I do

  • Penetration testing and security assessment
  • Applying secure software development principles
  • Advisory perspective on information security (ISO/IEC 27001:2022) and AI management systems (ISO/IEC 42001:2023)
  • Digital forensics: post-incident review and evidence-integrity perspective

Training completed: ISO/IEC 27001:2022 and 42001:2023 Lead Auditor courses, Cybersecurity Expertise, Ethical (White-Hat) Hacker Expertise, Cybercrime Expertise and Digital Forensics Expertise. Details are on the Certificates page. This page does not mean an organizational certification has been issued; it describes my personal training and hands-on experience.

How I manage work in this area

Compliance projects are often assumed to be paperwork; the real difficulty is drawing the scope correctly, owning the risks and collecting evidence from everyday work.

Steps

  1. Scope and context: which unit, process and assets the management system covers is written down.
  2. Risk assessment: assets, threats and risks are recorded together with their owners.
  3. Control and documentation plan: which control is applied how, and which records are kept.
  4. Implementation and record collection: controls are embedded in daily work so evidence is produced as a by-product.
  5. Internal review and audit readiness: gaps are found and closed before the audit.

Deliverables

  • Scope statement
  • Risk register and treatment plan
  • Policy and procedure drafts
  • Internal review summary and audit readiness list

Methods and tools

The project plan ties the scope–risk–documentation–review chain to a regular calendar. This is not a certification promise; it is a service for running compliance work in an orderly way.

Common risks and how I handle them

  • Scope drawn too wide or too narrow: Scope is reviewed together with business goals and the asset inventory.
  • Documents exist, practice does not: Controls are embedded in daily work; evidence comes from the process.
  • Risks without owners: Every risk gets an owner and a mitigation date.

Acceptance criteria

  • The scope statement has been approved by management.
  • The risk register is current; every risk has an owner and a treatment decision.
  • Policies and procedures reflect the work actually performed.
  • Internal review findings are closed or scheduled.

What I will ask you before we start

  • Which standard or customer requirement drives this work?
  • Which units, processes and systems will be in scope?
  • Are there existing policies and records?
  • Is there a target audit date and certification body?

Communication rhythm

A monthly management summary, fortnightly working meetings and an owned list for open items.

Why it matters for leading AI teams

My ISO/IEC 42001 lead auditor training helps me reduce AI governance to concrete questions: what is this system for, who is accountable, which data does it use, how is it monitored? In a C-level AI role those questions become the shared language between the technical team and the board.

Frequently asked

Do you issue certification?

No. Certification is the job of accredited bodies; I help plan and run the compliance work.

Is ISO 27001 meaningful for a small team?

Yes, when the scope is drawn small and realistic; we assess that in the needs conversation.

To get started: describe your goal in two or three sentences via Contact or on WhatsApp (+90 531 679 10 14). For my overall method see Project Management, for my working rhythm How I Work, and for other areas Services. I work remotely, including across time zones — see the FAQ.