Security management: implementation and audits
We build, implement and run your ISO 27001, TISAX or CSMS management system with you, from the first gap analysis to certification and daily operation.
A management system is only worth something if it works on a normal Tuesday.
A management system defines how a company handles information security: risks, rules, responsibilities, checks and improvement. Customers and regulators ask for proof of it, for example an ISO/IEC 27001 certificate, a TISAX label in the automotive supply chain, or a cybersecurity management system (CSMS) for vehicle type approval.
We do not stop at a gap list. For ISO 27001, TISAX and CSMS alike, we implement the system together with your team: policies and processes, technical and organisational measures, training and the internal audit, through certification or assessment and into daily operation, until you can run it on your own.
Who it is for
- Suppliers asked by customers for ISO 27001 or TISAX
- Vehicle manufacturers and suppliers that need a CSMS under UN R155
- Companies that fall under NIS2
- Teams without the capacity to build a management system alone
What management systems must deliver today
Expectations have grown. These are the topics auditors, customers and regulators now look at most closely.
Leadership
Management accountability
NIS2 makes management bodies responsible for approving and overseeing security measures.
Risk
Real risk management
Auditors expect risk decisions that drive measures, not a register filled once a year.
Suppliers
Supply chain security
Security requirements and checks for suppliers and service providers are now a core control.
Incidents
Detection and reporting
Incidents must be detected, handled and, under NIS2, reported within tight deadlines.
Automotive
TISAX labels
OEMs require TISAX labels for information security and, where relevant, prototype protection.
Vehicles
CSMS under UN R155
Type approval depends on a working cybersecurity management system across the vehicle lifecycle.
People
Awareness that sticks
Training must change behaviour, especially for phishing and handling of confidential data.
Continuity
Business continuity
Backup, recovery and emergency plans must be tested, not only written.
How we build systems that last
A management system should fit the company, not the other way round.
1
Implemented, not just written
Measures that work in daily operation, not only on paper.
2
Right-sized
A system that fits your company size and way of working.
3
One system, many labels
ISO 27001, TISAX, CSMS and NIS2 served by the same structure.
4
Risk drives measures
Every control has a reason in the risk assessment.
5
Fewer findings
Audits prepared with a rehearsal beforehand.
6
Independent at the end
Your team runs the system; we step back.
How we help
From the first gap analysis to daily operation. Start with one service, or let us take you through all of them.
Gap analysis and roadmap
Where you stand, and the way to certification.
What we do
- Assess your current state against the standard
- Define scope and target level
- Plan measures with owners, effort and dates
You receive
Gap list, implementation roadmap
ISO/IEC 27001 implementation
Your ISMS, built and introduced with your team.
What we do
- Risk assessment and Statement of Applicability
- Policies, processes and responsibilities
- Technical and organisational measures, awareness training
You receive
Working ISMS, documentation, trained staff
TISAX implementation and assessment support
From the first gap to the label your customer asks for, including the assessment itself.
What we do
- Define scope, assessment level and objectives with you
- Implement the VDA ISA requirements: policies, processes, technical and organisational measures, training
- Mock assessment, then support during the assessment by the audit provider
- Corrective action plan and follow-up until findings are closed
You receive
Implemented measures, support through the assessment, closed findings
CSMS implementation for UN R155
The management system behind vehicle type approval.
What we do
- Set up CSMS processes and roles
- Link them to engineering and post-production monitoring
- Prepare for the audit by the technical service
You receive
Implemented CSMS process set, audit preparation
Operation and continuous improvement
Keeping the system alive after certification.
What we do
- Risk reviews, management reviews and surveillance audits
- Support for incidents and new requirements
- External information security officer if you lack capacity
You receive
Ongoing support, up-to-date ISMS
Internal and supplier audits
An independent look before the official one.
What we do
- Audits against ISO 27001, VDA ISA, IEC 62443 or customer requirements
- Findings with clear actions
- Follow-up of open points
You receive
Audit reports with findings and actions
How we work
Step 1
Analyse
Gap analysis and roadmap.
Step 2
Implement
Processes, measures and training, with your team.
Step 3
Certify
Internal audit, then support in the certification audit.
Step 4
Operate
Reviews and improvement, until you run it alone.
Standards and regulations
ISO/IEC 27001:2022
International standard for information security management systems.
VDA ISA (TISAX)
Assessment catalogue used in the automotive industry, based on ISO/IEC 27001 and 27002.
UN R155
Cybersecurity management system for vehicle type approval.
NIS2
Risk management measures, management accountability and reporting.
ISO 22301
Business continuity management.
Industries
From automotive suppliers that need TISAX to operators under NIS2.
Why Nord CS
Our team holds IEC 62443 Expert, TISAX and NIS2 implementer qualifications, and our founder serves on the ENISA Advisory Board. Our experience covers automotive, rail, medical, OT and financial environments. AITIGRITY reviews documents and evidence against the targeted standard.
Talk to a consultantQuestions we often hear
Do you also implement the measures?
Yes. We build the management system with your team, from policies and processes to technical measures and training, and stay with you through certification.
Do you also implement TISAX requirements?
Yes. We implement the VDA ISA requirements with your team, prepare you with a mock assessment, support you during the assessment and help close any findings afterwards.
Do you issue certificates?
No. Certificates are issued by accredited certification bodies, and TISAX assessments are done by approved audit providers. We prepare you for them.
Can ISO 27001 and TISAX be combined?
Yes. VDA ISA is based on ISO/IEC 27001 and 27002, so most of the work serves both.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.