Audit-ready · Both
We're not ready for ISO 27001.
Certification is coming. A customer or investor wants ISO 27001, and evidence is scattered across inboxes. We get you ready, with the evidence collecting itself.
What it looked like
- Nobody knows who has access to what.
- Policies exist but nobody follows them.
- The last audit took six weeks of overtime.
02 · What we did, stage by stage
What we did, stage by stage
- Assess
A gap assessment against ISO 27001 Annex A and clauses 4–10, ranked by effort.
- Map
We map systems, data flows and access across Microsoft Entra, Google Workspace, ERP and CRM.
- Mature
Policies, a risk register, an access review procedure and owners for every control.
- Automate
Quarterly access reviews and change records write their own evidence.
- Run
We run reviews, keep the evidence current and support you through surveillance audits.
03 · The process
User access review for ISO 27001
Every quarter, accounts are pulled from every system, managers confirm who needs what, the rest is removed and the evidence files itself.
What changed
- Audit preparation6 weeks3 daysExample
- Quarterly access review3 weeks2 daysExample
User access review for ISO 27001
- Quarter starts
- Pull every account
- Match to HR list
- Orphan accounts?
- Manager attests
- All access justified?
- Evidence recorded
- Review closed on time
- Quarterly access review: 3 weeks → 2 days (Example)
05 · Questions
Questions
Do you certify us?
No, Devvion gets you ready; an accredited certification body audits and certifies. We stay with you through the audit and answer findings.
How long does it take to get ready?
Devvion typically gets a company of 50–500 ready in three to six months, depending on scope and how much already exists.
06 · Contact
Book the assessment.
Tell us what is slowing the business down. We'll confirm the scope and the dates on a first call.