The client
A leading provider of strategic management software for End User Computing (EUC) who is committed to ensuring the integrity of business operations. Trusted by world leading institutions in 20 countries on five continents their solutions help firms balance their governance, risk and regulatory compliance (GRC) obligations with the need for revenue generation, staff efficiency and productivity.
The work
Having developed a new Software as a Service (SaaS) platform for clients, customer demand for external accreditations, and the importance of services supporting customer regulatory compliance, the client wanted to provide buyers with assurance over the rigour they apply in the design, control and ongoing development and operation of their services.
How we helped
We worked with the UK board, and investors, to agree that the assurances
that would most likely be demanded by purchasers would be the International Standard on Assurance Engagements (ISAE 3402) Assurance Report on Controls at a Service Organization and the International Information Security Standard (ISO/IEC 27001).
Our Information Security consultants undertook a gap analysis of the client control environment against both ISAE3402 and ISO/IEC 27001 to prepare a comprehensive gap analysis and required remediation plan. We then worked with operational management to enhance their Information Security Management System (ISMS) to establish a common control
framework that could be operated to meet the requirement of both Standards. By working collaboratively we helped the client successfully obtain a Type 1 ISAE3402 attestation and to gain certification to ISO/ IEC 27001 via both Stage 1 and Stage 2 audits on the first attempt.
Value added
By focussing on the reporting requirements of both Standards, and control overlap between them, we were able to design a single control framework that could be operated as part of their Business As Usual (BAU) operations which was operationally efficient and reduced the overall cost of compliance.