Information Security and Information Systems

We help organisations protect security-classified information and other information requiring protection, together with the information systems that process or support it. The work is tailored to the organisation's assets, deliverables, risk picture, technological environment and regulatory requirements, so that security is comprehensive, risk-based and practicable.

Comprehensive protection of information and systems

We assess confidentiality, integrity and availability throughout the system's life cycle. The system is viewed as a whole made up of people, processes, technology, locations, data flows, integrations and suppliers – not as an isolated technical solution.

Our advisers combine the requirements of the Security Act, NSM's basic principles and ISO/IEC 27001 and 27005 with practical experience of governance, architecture, operations, incident management and system approval. This provides traceability from assets and risk to requirements, measures, testing and approval.

The advice may include

mapping and classification of information, systems, components, data flows, integrations, users, deliverables and dependencies
assessment of requirements for confidentiality, integrity and availability, including damage assessment, classification, marking, storage, transfer and destruction
risk assessment of information systems, identifying threats, vulnerabilities, existing measures, residual risk and the need for risk treatment
establishment or further development of an information security management system, policies, roles, tolerance limits, control objectives and governing documentation
design of security architecture and requirements for, among other things, identity and access management, least privilege, authentication, segmentation, secure configuration, encryption and physical protection
assessment of logging, monitoring, detection, vulnerability management, patching, backup and protection against malware and unauthorised changes
preparedness for digital incidents, notification procedures, incident management, continuity, recovery, exercises and learning
security in procurements, development, changes, operations, cloud services, outsourcing and supply chains
preparation of system descriptions, security objectives, security requirements, risk registers, control matrices, Statements of Applicability and risk treatment plans
gap analyses and maturity assessments against the Security Act, NSM's basic principles, ISO/IEC 27001 and other relevant requirements and frameworks
assistance with documentation, testing, control and preparations for the approval of information systems requiring protection
training and awareness-raising for management, system owners, administrators, users and suppliers

What does the organisation receive?

The organisation receives a prioritised overview of critical information assets and systems, applicable requirements, established controls and necessary improvements. The deliverable may include a system overview, risk assessment, security concept, control matrix, action plan and supporting material for management decisions, audits, inspections or system approval.

← Back to Security Act and Risk Analysis

Submit the form below and we will get in touch with you.