Services

Information Security

Information Security

ISMS build-out, ISO 27001 readiness, risk assessment, data protection and supplier assurance — sized to your organisation, not copied from a template.

Why Choose Anawaz?

Wallpaperflare com wallpaper — Anawaz

Security governance that survives an audit and still works on an ordinary Tuesday. We help you build an information security management system your team will actually follow — policies, risk assessment, access control, supplier due diligence and the evidence trail — sized to your organisation rather than copied from a template.

  • ISMS & ISO 27001 Readiness – Scope, risk assessment, Statement of Applicability, and the evidence trail auditors actually ask for.

  • Policies & Procedures – Written for the people who have to follow them, not to fill a binder nobody opens.

  • Risk Assessment & Treatment – Identifying what would genuinely hurt the business, and deciding deliberately what to do about each risk.

  • Data Protection & Privacy – Data mapping, retention, lawful basis and subject-request handling under GDPR and equivalent regimes.

  • Awareness Training & Supplier Assurance – Practical staff training, and a due-diligence process for the third parties holding your data.

Building an ISMS that survives contact with Tuesday

Certification bodies audit the management system, not just the controls. The work that carries the effort is the part organisations consistently underestimate:

  • Scope — defined precisely, including what is excluded and why. Auditors probe boundaries hardest, because that is where inconvenient systems get hidden.
  • Risk method — a repeatable way to identify, rate, treat and accept risk, applied to your actual business rather than a downloaded register.
  • Statement of Applicability — every control, applicable or not, with the reasoning recorded.
  • Evidence that the system runs — management reviews, internal audits, corrective actions, access reviews, incident records and training logs, accumulated over months.

That last item is why certification timelines are measured in months. You cannot manufacture a year of operating evidence in a fortnight.

The test we apply to every document

Would you do this if there were no audit? If not, either the process is wrong or the document describes something you do not actually do. Systems built for the auditor pass once and then decay, because nobody follows a process that exists only to be inspected.

Common questions

ISO 27001, SOC 2, or Cyber Essentials?
Let the buyer decide. Ask which your customers and target tenders actually name, and pursue that. We cover the differences in our guide to what ISO 27001 certification really requires.

Can you certify us?
No — and nobody who helps you prepare can. Certification must come from an independent body. We prepare you for that audit and will tell you honestly when you are not yet ready.

Do we need to certify at all?
Only if there is a commercial reason. If the goal is genuinely to be more secure rather than to prove it, the same budget spent on testing, remediation and access control usually produces a larger improvement.

Who owns this internally?
Someone must, and it is a real time commitment rather than a side project. Naming that person early is the single biggest predictor of whether the programme succeeds.

Testimonials

What our clients say