ISO 27001
We help turn a gap assessment into a working information security management system. We agree scope, responsibilities, a work plan and how controls will be checked. We prepare documentation and staff for the audit; an independent body, not Virtline, decides whether to award certification.
Trusted by
ISO/IEC 27001 sets requirements for an information security management system (ISMS). A gap review assesses the current position and identifies weaknesses. Implementation covers agreed changes to processes, documentation and controls. Certification preparation brings together internal audit results, management review and corrective actions before an independent body’s assessment. Not every company needs to start implementation from scratch, and a gap review is not certification. The system covers people, processes and technology, not a single IT product.
We connect management-system work with the team’s daily tasks. Each service has a separately agreed scope.
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateThe plan reflects existing arrangements, team availability and the project objective. We discuss each stage’s results with the people responsible for decisions.
We review policies, processes, systems and records of control operation. We agree ISMS boundaries, dependencies, customer requirements and responsibilities. The assessment considers ISO/IEC 27001:2022 and the relevant national edition, including PN-EN ISO/IEC 27001:2023-08 in Poland.
With risk owners, we assess risks and treatment options: acceptance, reduction, transfer or avoidance. We explain the choice of organisational, people, physical and technological controls from Annex A (A.5–A.8). Management approves decisions and resources.
We prepare or improve documentation, implement agreed controls and train staff. We check access, incident-handling and business-continuity procedures. Recovery tests are assessed against agreed service recovery time (RTO) and tolerable data loss (RPO); results and gaps are recorded.
We help conduct the internal audit and prepare management review and corrective actions. We organise material and prepare staff for discussions with the certification body’s auditor. Ongoing ISMS support is agreed separately.
Practical scope
Each item shows the actual position, its owner and decisions that remain with your company.
Organisational context, interested parties’ needs, processes, locations, critical systems, data categories, assets and suppliers. The report includes the current position, priorities, a documentation map and a list of missing material.
Assessment method, acceptance criteria and a register with owners, decisions, deadlines and action status. We prepare a Statement of Applicability (SoA), explaining the selection of controls and exclusions from Annex A.
Policies, procedures, registers, roles and a review schedule. The record covers access, multi-factor authentication (MFA), administrator accounts, segregation of duties, granting and removing permissions, networks, backups and recovery tests, logs, monitoring, updates, vulnerabilities, supplier requirements, incidents and changes.
Test and training records, supplier assessments, internal audit results, management review, corrective actions and open issues. We agree who updates documents, evaluates control effectiveness and reports progress to management.
Virtline advises and supports implementation; your company remains responsible for business decisions, risk acceptance, resources and day-to-day application of its rules. We plan internal audits to preserve objectivity and impartiality, assigning implementation and assessment roles separately. An independent body carries out certification, and the certificate relates to a defined ISMS scope. We do not guarantee a successful audit, an absence of incidents or winning a contract. Virtline’s own certificate does not automatically cover clients or authorise us to certify them.
No. A gap review identifies readiness and weaknesses, but does not replace necessary changes or a certification audit. Virtline can help prepare the system and material for assessment. The independent body defines its assessment process and makes the certification decision.
Virtline’s offer gives an indicative duration of 4–9 months, not a guaranteed deadline. It depends on ISMS scope, locations, processes, systems and suppliers, documentation maturity, team availability and records of control operation. We agree a plan and budget after assessment. The certification body’s assessment cost is separate from implementation work.
Controls and documentation still need maintenance, along with risk and access reviews, training, tests, internal audits, management reviews and corrective actions. Certification usually follows a three-year cycle with annual surveillance audits; renewal requires reassessment. The certification body defines exact dates and conditions. Virtline can support ongoing operation under a separately agreed scope.
No. A structured risk assessment, controls and records can help with NIS2, DORA, GDPR and TISAX assessments, customer questionnaires, tenders and supplier reviews. They can also help a statutory auditor understand the IT environment in an audit under Polish auditing standard KSB 315, including financial-system access, changes and backups. Each purpose has its own scope; an ISO certificate does not automatically confirm that all obligations are met.
Describe your sector, locations, processes, customer expectations and target date. Outline existing policies, the risk register and your current stage: assessment, implementation, certification preparation or ongoing operation. Do not send passwords or confidential documentation through the form.
Discuss your ISO 27001 scope