SOC2 and ISO 27001 Certification Consultants in Brisbane

Ketki Tidke

Cyber Security and GRC Lead Auditor

ISO 27001 Lead Auditor

Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.

Gap Assessment and Maturity Review

Your current practices are compared with ISO 27001 requirements to show exactly where the organisation stands.

Deliverables: gap assessment report, recommended action plan.

ISMS Scope Definition

Define which departments, locations, assets, technologies, and products the ISMS will cover.

Deliverables: documented ISMS scope statement and BPD.

Asset Inventory and Risk Assessment

Identify all information assets and evaluate risks using a structured methodology.

Deliverables: asset register, risk assessment report, risk treatment plan.

Statement of Applicability (Mandatory Document)

The SoA is one of the most important ISO 27001 documents. It lists all 93 Annex A controls and marks each as applicable or not applicable, with a justification and its implementation status.

Deliverable: official Statement of Applicability.

Documentation Development

Prepare all mandatory and supporting documents, including the Information Security Policy, Access Control Policy, HR Security Policy, Asset Management Policy, Backup and Restore Policy, Supplier Security Policy, Business Continuity Policy, Incident Management Procedure, Risk Management Procedure, and Evidence Collection and Retention Procedure.

Deliverables: ISMS document set (20 to 30 documents).

Implementation of Controls

Policies and controls are put into action, such as MFA, password policies, access approval flow, antivirus, logging, endpoint monitoring, backup automation and restoration testing, asset tagging, security awareness training, vendor evaluations, and BCP and disaster recovery preparation.

Deliverables: operational controls activated, tool configurations, awareness training logs.

Evidence Collection

Real, time-stamped evidence must show that controls are functioning, such as access logs, backup reports, training attendance sheets, incident ticket records, change management approvals, vendor assessment reports, patch reports, CCTV access logs, password policy screenshots, and asset inventory logs.

Deliverable: full evidence collection folder mapped to each control.

Internal Audit

An internal auditor checks whether the ISMS and its controls are implemented correctly.

Deliverables: internal audit report, non-conformities identified, corrective action plan.

Management Review Meeting

Management reviews ISMS performance, resource allocation, risks, KPIs, and improvements.

Deliverables: minutes of meeting, leadership commitment confirmation.

Stage 1 External Audit (Document Review)

The external auditor checks that all mandatory documents exist, the risk treatment plan and SoA are correct, and policies meet ISO 27001 requirements.

Deliverables: Stage 1 audit report, observations and gaps to fix.

Stage 2 External Audit (Implementation and Evidence)

The auditor verifies real implementation through samples, screenshots, logs, and employee interviews. They look for control effectiveness, records that match policy commitments, risk treatment implementation, BCP and DR readiness, and incident handling proof that reflects obligations such as the Notifiable Data Breaches scheme.

Deliverables: Stage 2 audit report, final non-conformities (if any).

Certification Issuance

Once all non-conformities are closed, the certification body issues the ISO 27001 certificate, which is valid for 3 years.

Surveillance Audits (Year 2 and Year 3)

Yearly checks confirm the ISMS is being maintained, and evidence must be available every year.

Deliverables: yearly surveillance audit reports, updated SoA and risk treatment plan.

Recertification Audit (After 3 Years)

A full reassessment of the ISMS renews the certification for the next cycle.

Readiness Assessment

The cybersecurity experts at CyberSapiens review your existing security controls, documentation, and workflows. They identify gaps against SOC2 requirements and deliver an actionable roadmap to compliance.

Policy Development and Documentation Support

Specialists develop or refine policies for access control, change management, incident response, vendor management, and data protection. All documentation is aligned with auditor expectations and built into daily operations.

Control Implementation and Remediation

CyberSapiens works with your internal teams to remediate gaps and deploy the administrative and technical controls needed. The aim is full alignment with the five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Evidence Collection and Internal Review

The team helps collect and organise audit evidence, including logs, screenshots, system configurations, and training records. Internal reviews and mock audits confirm that controls work before the formal audit begins.

SOC2 Type I and Type II Coordination

For either report type, CyberSapiens manages audit coordination, including auditor communication, evidence submission, and walkthroughs. For Type II, the team supports you through the observation period so controls perform consistently over time.

Report Issuance Support

After the audit concludes, CyberSapiens helps interpret the results, resolve any findings, and implement improvements that strengthen your security posture.

Continuous Monitoring and Annual Maintenance

SOC2 requires yearly recertification, so CyberSapiens provides periodic reviews, internal audits, evidence updates, and continuous improvement activities to maintain long-term adherence.