Articles

An information security management system (ISMS) is the set of policies, processes and controls an organisation uses to manage information security risk. ISO 27001 is the international standard that describes how to build one.

A pre-audit checks your ISMS against the standard before anyone external judges it. We review your documents, records and practice, and report where you meet the requirements, where you meet them partly, and where you do not.

It is not certification. Only an accredited certification body can issue an ISO 27001 certificate, after its own audit. A pre-audit is useful because it shows what that audit, or your customer's review, would find while you still have time to fix it.

Security questionnaires often arrive from customers, especially banks and insurers, before a contract is signed. They ask which controls you have, and your answers can become commitments in the contract.

Three habits help. Answer only what you can prove, and keep the evidence (a policy, a record, a screenshot) next to each answer. Say "partly" when it is partly true, and explain the plan. Keep one reviewed set of answers, so every new questionnaire starts from something consistent.

A pre-audit helps because it gives you an honest map of your controls to answer from.

A small company does not need to do everything at once. A sensible order looks like this:

1. Define the scopeDecide which parts of the business, systems and locations the ISMS covers.
2. Assess the risksIdentify what could harm the confidentiality, integrity and availability of your information.
3. Choose the controlsUse the Annex A controls as a reference list, and record your decisions in a Statement of Applicability.
4. Write policies and keep recordsPut the controls into practice and keep evidence that they work.
5. Review internallyRun an internal audit and a management review before inviting a certification body.

A pre-audit fits before the last step: it shows which of the earlier steps still have gaps.

Banks, insurers and similar firms depend on suppliers for software, hosting and data processing. If a supplier is breached, the financial company and its customers can be affected, so regulators expect the company to manage that risk.

In the EU, rules such as DORA require financial entities to manage the risks of their ICT third-party providers. This is why suppliers now meet more questionnaires, contract clauses and audit requests.

For a supplier, the practical answer is to be ready to show a defined scope, a risk assessment, baseline controls and an incident response process. Being able to show them quickly makes selling to financial customers easier.