Getting Started: Project Planning and Scoping
A practitioner's guide to launching an ISO 27001 implementation — securing the mandate, assembling the right team, defining a scope that is both defensible and achievable, building a realistic project plan, and establishing the governance structures that keep the program on track from week one to certification.
Explore Resource
Gap Analysis and Current State Assessment
How to assess your organization's current security posture against ISO 27001:2022 — the assessment approach, evidence collection, gap scoring, heat map structure, and how to turn findings into a prioritized remediation roadmap that drives the rest of the implementation.
Explore Resource
Building the ISMS Framework
How to design and build the structural architecture of your ISMS — the governance model, policy hierarchy, document control system, and the connections between ISMS components that turn a collection of documents into a coherent, auditable management system.
Explore Resource
Risk Assessment Methodology
How to design, document, and apply a risk assessment methodology that satisfies ISO 27001:2022 requirements, produces credible and consistent results, and drives a risk treatment plan that genuinely reduces information security risk in the Indonesian regulatory context.
Explore Resource
Selecting and Implementing Controls (Annex A)
How to translate risk assessment findings into a prioritized control implementation program — navigating the 93 Annex A controls, building the Statement of Applicability, creating a risk treatment plan, and implementing controls with the evidence quality that certification audits require.
Explore Resource
Developing Policies and Procedures
A practitioner's guide to writing the ISMS documentation that actually governs security behavior — including annotated policy and procedure templates, document development workflow, common mistakes that generate audit findings, and the minimum document set needed for certification.
Explore Resource
Staff Awareness and Training
How to design an awareness program that genuinely changes security behavior — not just produces completion records. Includes a complete 11-module curriculum, phishing simulation program, competence framework for ISMS roles, KPI dashboard, and the evidence framework that satisfies both auditors and real security outcomes
Explore Resource
Internal Audit Process
How to design and execute a genuine internal audit program — building the audit universe, scheduling risk-based audits, applying the right evidence collection methods, writing findings that drive real improvement, and using the pre-certification readiness checklist to close the gap between 'audit conducted' and 'certification ready'
Explore Resource