ISMS Auditor Competence
One of the topics that generates questions from a large number of clients is who can conduct internal ISMS audits.…
Further information
A strong pedigree in information security
I’ve worked in information technology and information security for many years – I completed my first Information Security Manager’s course in 1994 while serving in the Royal Air Force Police . Needless to say, things have moved on a bit since then…
Before starting out as a freelance consultant, I worked for IT Governance Ltd, a leading global provider of cyber risk and privacy management solutions, as a Senior Consultant then as a Consultancy Manager where I had the pleasure of supporting many organisations through their information security improvement journey. As the company’s ISO 27000-family “champion”, I also provided support and mentoring to consultants within my team and across the wider business. Duties included representing the company (and auditors in general) as a member of the CAS(T) User Group, the NCSC assurance scheme for organisations in the telecoms sector.
As a freelancer, I’ve worked with and supported a number of clients on AICPA SOC 2 and ISO 27001 projects from inception through to successful Type I & Type II audit and certification of the newly established ISMS. I’ve also helped companies meet the requirements of the NCSC / IASME Cyber Essentials scheme and supported a client through accreditation to the requirements of the UK Forensic Science Regulator’s Code of Practice and Conduct, the FSR-C-100.
I keep abreast of and contribute to developments in the ISO 27000-family of standards by sitting as a member of IST/33/1, the UK National Standards Body committee responsible for the ISMS family of standards. The scope of IST/33/1 includes the ISMS requirements detailed in ISO 27001, the reference set of controls in ISO 27002, and other guidelines, accreditation and auditing, and sector-specific ISMS standards such as ISO 27005, ISO 27006, ISO 27017 and ISO 27018.
Some key acheivements
- Leading the design and implementation of an ISO 27001 ISMS for a legal technology start-up consisting of 1 single Director/founder. The ISMS achieved accredited certification and the business has gone on to be a huge success
- Supporting a FinTech client through all aspects of their AICPA SOC 2 audit project from initial scoping of the relevant TSC and CPA selection through to drafting of the system description, including control narratives and carve-out of subservice organisation controls, leading to the initial Type I audit followed by successful initial and ongoing SOC 2 Type II audits
- Leading the successful implementation and certification of a multi-standard management system framework comprising ISO 9001, ISO 22301 and ISO 27001 for a major UK law firm with a >£30m contract value benefit to the organisation
- The implementation and certification of an ISO 27001 ISMS for a regional law firm with >500 employees distributed over 5 sites in 4 counties
- Leading the successful implementation and certification of an ISO 27001 ISMS for a global satellite telecom services provider (>1500 staff, offices and operational facilities in >40 countries)
- The implementation and certification of an ISO 27001 ISMS in tight timescales for a global software development company in order to secure business with a value >£8m (>500 employees with offices Canada, UK, India, Japan and Brazil
- The planning, coordination and execution of a supplier assurance programme for a major vehicle manufacturer
Real world operational experience
Before information security became my primary focus, I held a number of operational IT roles. My experience includes providing service and support in a customer-facing helpdesk position, forming and managing internal IT service delivery and technical teams, and setting up an IT managed services arm for an expanding company in the digital print sector.
When I left IT Governance I took a year-long foray back into the world of operational IT as an interim IT Director for a large housing association; my tenure coincided with the start of the COVID-19 pandemic which drove the need move the organisation from a legacy office-based way of working where everyone worked from a set desk to the “new normal” of remote and hybrid working from home offices and kitchen tables usng modern collaboration applications such as Teams in Office365 on new-fangled laptop devices. Although there were many challenges, my team an I successfully mpoved the entire organisation to a secure and flexible working posture within a very short period of time.
Poacher turned Gamekeeper
Having sat on the ‘sharp’ side of the desk, I understand the challenges and tensions in delivering technology services in a secure manner and appreciate the business and commercial challenges faced by senior and executive IT management. I’m able to see these challenges from a business perspective as well as from the viewpoint of a certification body or relevant standard. This allows me to help clients meet ISO 27001 and other requirements in a manner that doesnt break the bank or the business!
When it comes to audit, my information security, technical, and business background is a massive benefit as I’m able to audit and challenge working practices and technical controls based on real world experience.
My background provides perspective on and background knowledge of some common problem areas that may get missed by other auditors. Having these exposed during internal audit can help avoid costly incidents as well as providing increased assurance to you and your certification body that the internal ISMS audit has been robust.
Over the years working in IT, I passed 19 Microsoft technical exams plus a plethora of other technical exams – qualifications range from the obligatory HNC thru ITIL and PRINCE 2 foundations, certified Watchguard System Professional and even Apple Desktop Support Engineer.
In order to keep up to date with the changing world of information and cyber security, I’m currently studying for the ISC2 CISSP qualification
Qualifications include:
|
|
|
|
|
|
|
|
|
|
|
|
Costs will be discussed when scoping a project or piece of work as the number of variables associated with any piece of work makes it unrealistic to quote a standard day rate for all clients and every type of engagement.
The fee payment structure can be tailored to suit your needs – a standard day rate for an agreed number of days, a monthly invoice for days called off over the period or milestone based payment structure.
All standard expenses such as hotels, travel and subsistence will be discussed before any expenditure and will be invoiced back to the client at cost; wherever possible, we will comply with your travel, subsistence and expenses policies for overseas engagements.
We are VAT registered so all fees will have 20% VAT added during invoicing.
Payment terms are 30 days from issuing an invoice.