A preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization’s information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.
This is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation.
This part involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually.
There are specific points in your ISMS project at which Application Security Testing has a significant contribution to make:As part of the risk assessment process, uncovering vulnerabilities in any web applications, or internal applications, and linking them to identifiable threats. Using AIAST enables you to conduct External tests, focusing on web applications and other such services and on On-site tests, focusing on the various applications and operating systems that run on your internal devices. Once you completed your scans, you can produce a detailed and documented report that clearly sets out what you have found together with an assessment of its severity, and our recommendations for appropriate remediation, you can link integrate your AIAST solution directly with your SDLC tools with full automation and scale up the process.