01
Discussion and scope
We agree the purpose, systems, locations and processes, then schedule the work and identify people who can provide documents and explain current practices.
ISO 27001
ISO 27001 readiness assessment
We review your documentation and safeguards before ISO 27001 implementation or certification. You receive findings, priorities and a proposal for the work still needed.
Trusted by
Companies and institutions that need stable IT.
Where should ISO 27001 preparation begin?
A readiness assessment is an initial review of your information security management system: the rules, responsibilities and safeguards used to protect information. It shows what works, what needs improvement and what is missing. You can commission it before implementation, ahead of certification or after a significant organisational change.
Audit scope and related services
We agree the scope for specific systems, locations and processes. PN-EN ISO/IEC 27001:2023-08 provides the requirements baseline; we examine documentation and examples of safeguards in use.
ISO 27001 audit and implementation
We check which information and processes the management system covers. We review policies, information classification, objectives, risk assessment and assigned responsibilities.Cybersecurity for businesses
We assess access provisioning and removal, administrator accounts, multi-factor authentication and asset protection. We review configurations, updates and vulnerability handling.Backup and data recovery
We review security incident handling, monitoring, backups and recovery test results, including arrangements for working through an outage.IT outsourcing for businesses
We examine supplier requirements, contracts and procedures. We review records of completed checks, internal audits and management reviews.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. Our published certificate gives its scope and validity.
View Virtline’s certificateAudit process
You do not need completed ISO documentation. We agree which materials are available, who should join the discussions from each area of the business and how to review the environment safely.
02
Review and interviews
We examine documentation and agreed samples of configurations and completed checks. We speak with IT, management and the people responsible for the processes.
03
Assessment and report
We check which ISO 27001 requirements your business already meets and which need further work. The report describes identified gaps and recommended improvements, and indicates the areas we could not verify.
04
Discussion and follow-up
We present the report and proposed work sequence. Implementation support or a repeat review can be scoped separately if required.
Practical scope
What you receive
We present findings for management and the technical team. The report also states the limits of the assessment and anything we could not verify.
The main gaps, their possible impact on your business and the decisions needed to start improvements, without requiring a review of all technical documentation.
Reviewed areas, observed conditions, gaps and recommendations, with the documents, configurations or test results supporting each finding identified.
Tasks with priorities, dependencies and proposed responsibilities, including the documents and records that need to be prepared or completed.
A presentation of the findings and a discussion of the work sequence. We distinguish documentation changes from technical work and identify where further checks are needed.
Readiness assessment versus certification
This service is not a certification audit and does not award an ISO 27001 certificate. Certification is conducted by a chosen certification body, such as TÜV NORD. We can help prepare your organisation, but do not guarantee the outcome of its later assessment. For internal audits, we agree impartiality safeguards and do not present a review of our own implementation as independent.
Questions about readiness assessments
Will we receive a certificate after this assessment?
+
No. You receive findings and preparation recommendations. A certification audit is a separate service from your chosen certification body. A readiness assessment does not guarantee certification.
Is an assessment useful without ISO documentation?
+
Yes. We can review current practices, safeguards and existing documents. This identifies what can be used in an implementation and what still needs to be prepared.
Can you also carry out an internal audit?
+
Yes, subject to an agreed scope, auditor competence and impartiality arrangements. We do not describe a review of our own implementation as independent. An internal audit is not certification either.
What determines the cost and timing?
+
The number of systems, sites and processes, and the availability of documentation and interview participants. We first establish the scope and any planned certification date, then propose terms and a feasible schedule.
Preparing your business for ISO 27001?
Tell us whether you are starting implementation, already have documentation or are planning certification. Include your locations and target date so we can discuss the assessment scope.
Discuss the assessment