ISO 27001:2022 Certification preparation services

Our objective is to ensure that you, as a participant, have a credible and effective cybersecurity program certified to the  ISO 27001:2022 standard.

We help you implement the management practices and security controls  required by the ISO 27001:2022 standard.  To save costs, we work in teams to help individual participants create the required policies, procedures, and technology controls.

To support our objective, we provide our participants: (1) all policy and process templates required by the ISO 27001 standard; (2) security expertise from individuals with certifications and experience helping organizations achieve ISO 27001:2022 certification; (3) education, leadership and support on all certification requirements; (4) help with completing the required annual risk assessment; (5) facilitation of incident response and business continuity table top exercises; and (5) a security awareness presentation given to all employees and relevant contractors.

Certification preparation takes between six and nine calendar months, depending on the completeness and maturity of the participant's cybersecurity program.

All participants must assign an individual a part-time responsibility to participate in this program.  Additionally, prior to engaging in collaborative sessions, participants must complete an ISO 27001:2022 Readiness Questionnaire to identify program gaps and needs.  All participant information is kept confidential through a signed Non-Disclosure Agreement.

Costs range from $24,000 to $49,000 and are based on responses to the ISO 27001:2022 Readiness Questionnaire. 

• Vulnerability scanning and penetration tests are not covered and will be billed additionally upon request.
• The registration audit and costs are separate and billed independently by the Registration auditor.  MyDataOnly will recommend a registration auditor and seek the lowest cost deals on behalf of participants.
• Additional costs are required if MyDataOnly staff are required to complete policy and process templates, or to provide internal audit activities.  However, guidance on how these should be completed is provided as part of the service (no additional charge).

Understanding Your Security Program 

• Security 101: Fundamentals for Executives
• Privacy & Security: Historical and futuristic perspectives
• Your company’s privacy and security profile
• Your fiduciary and transformational roles

Developing Program Insights for Effective Decision Making 

• Questions to ask your security team
• Interpreting the answers to those questions
• Current industry breach and security developments
• Techniques for effective program guidance

• Setting the Boardroom security agenda
• The top 10 security metrics you must continuously monitor
• Measuring your Program against the industry
• Baselining your Program for continuous improvement

Engaging a Virtual CISO / Cyber Security Professional

• Advisory member of the Board
• Security Program leadership
• Fully outsourced security services
• Staff augmentation

• Policy and procedures development
• Risk and compliance assessments
• User and security staff education
• Security architecture and technology implementation

• ISO 27001 ISMS development
• Establishment of and support to your Governance Committee
• Complying with privacy laws and regulations
• PCI-DSS assessment preparation
• Third Party security
• Security metrics

• Applications and infrastructure vulnerabilities scanning
• Security controls testing
• Internal and external penetration testing (Cloud and On-Prem environments)
• Remediation guidance and support

• Creating an effective incident management plan
• Developing a business continuity capability
• Developing third party notification procedures
• Breach reporting assistance and support