Context & Need
The client is a renowned engineering and construction group with a long history of involvement in Italian landmark projects. Employing around 600 people, they provide engineering solutions in diverse sectors. To enhance their quality, efficiency, environmental performance, health and safety record, collaborative working, information management, and business resilience, the client decided to obtain the ISO/IEC 27001 certification.
The Solution
We assisted the client in implementing an Information Security Management System (ISMS) that met the ISO/IEC 27001 standards. The project took a year to complete and involved:
- Conducting an initial gap analysis to identify existing strengths and weaknesses
- Enhancing the client’s IT infrastructure and formalizing a data management policy
- Developing policies and stress-testing scenarios to address challenges and ensure benefits were communicated across the business
- Providing training to critical team members to become proficient internal auditors
- Carrying out a risk assessment to identify gaps in the system and allow for improvements prior to the third-party audit
- Delivering training sessions and presentations to ensure full understanding and engagement across the business, from senior management to operational and support staff
Key Features
- Implementation of an ISMS that meets ISO/IEC 27001 standards
- Gap analysis and risk assessment to identify areas for improvement
- Development of policies and procedures to enhance information security
- Training and awareness programs for staff
- Internal auditing and continuous monitoring to ensure compliance
Results & Measurable Impact
- Centralized Security Governance was implemented, streamlining information security processes
- Clear roles and accountabilities were established among team members
- Increased resilience to cyber-attacks was achieved
- Company reputation improved significantly
- A more mature Information Security landscape was established, with sustained and streamlined processes
Strategic Impact
By obtaining the ISO/IEC 27001 certification, the client demonstrated their commitment to information security and enhanced their overall business resilience. The implementation of an ISMS has improved their ability to protect sensitive information, reduced the risk of cyber-attacks, and increased stakeholder trust. The client’s reputation has improved, and they are now better positioned to compete in the market, having demonstrated their dedication to information security and quality management.
