Information security compliance and governance

ISO/IEC 27001 is the international standard for information security management systems. Certification shows customers and partners that the organization manages its risks systematically. Certification is granted by an accredited body; our role is to prepare your organization for that process.

We carry out the gap analysis, support the risk assessment and help implement technical controls such as access management, event logging, backup and secure communications. Cybersecurity assessments provide the testing evidence the standard values.

Companies in the financial system, insurers and pension fund administrators are subject to regulations from Peru’s Superintendency of Banking, Insurance and AFP on information security and cybersecurity management. These regulations require, among other measures, controls over cloud services, incident management, security testing and continuity.

We support these entities with a technical assessment against the regulation, implementation of controls and preparation of evidence. Recovery requirements can be addressed together with our business continuity service, and cloud requirements with our cloud solutions.

Compliance does not end with an audit. It requires reviewing access periodically, keeping logs, updating policies when systems change and measuring indicators. We define with you the owners, procedures and reviews needed to keep controls in force, and we can include their follow-up in our managed services.

In an audit, a supervisory review or a request from a corporate customer, it is not enough to say a control exists: you have to prove it. That is why every control we implement comes with its evidence, such as access logs, user review reports, restore test results or security assessment reports.

We organize that evidence by standard and by control, with dates and owners, so your team can present it without rebuilding it every time. The evidence is updated at each periodic review.

Much of an organization’s information now lives in third-party services: public clouds, email, CRM or payment platforms. Data protection laws and sector regulations require control over those suppliers: knowing what data they process, where they store it, what security measures they apply and what happens to the information when the contract ends.

We help you inventory these services, review their configuration and document the controls, so that using the cloud does not become a compliance gap.

Compliance is easier to sustain when management can see how it is progressing. We propose a short set of indicators, such as the percentage of accounts with multi-factor authentication, the number of high-risk findings open, the date of the last successful restore test or the time taken to remove access when someone leaves the organization.

These indicators are reviewed periodically and turn security into a topic that can be managed with data, not only with good intentions.

We agree the indicators with you at the start, so the first review already shows a baseline against which progress can be measured.