Mongi Mahmoudi

Support for the implementation of an ISMS ISO 27001:2022

• Project management and monitoring with agile iterations;

• Identification of deliverables and quality review of deliverables, milestones, and project phases;

• Project risk management: Resources/Budget/Deadlines;

• Gap analysis and SWOT analysis (Internal and External Issues);

• Process mapping and data flow diagram (DCP, Sensitive data...);

• Identification of legal and regulatory requirements (GDPR, NIS 1&2, PI, Digital Vault, ...);

• Review and integration of security in contracts;

• Identification of stakeholders and their information security requirements;

• Inventory of assets and Microsoft Azure cloud infrastructure;

• Development of the information security policy;

• Identification of security objectives and associated indicators (KPIs);

• Design of a risk analysis methodology based on ISO 27005:2022;

• Risk analysis to integrate vulnerabilities and mitigations into the security architecture;

• Risk treatment plan and DDA;

• Support for integrating security principles into ISP projects;

• Development of internal and external communication plans;

• Performance monitoring plan: Design of performance indicators (KPIs)

• Development of security procedures and policies and specific policies

• Definition of security perimeters and design of security controls and measures;

• GDPR compliance;

• Information security awareness;

• Security in development projects (MFA Authentication, cryptography, key Vault, CI/CD integration security, SCA, SAST, DAST, ...)

• Internal audit program, management review, and corrective actions;

• Facilitating meetings with management and the project team;

ISMS implementation according to ISO 27001:2013 & 2022, Internal Audit ISO 27001:2013 & 2022, ISO27005 risk analysis and development of client-specific risk analysis methodologies, BCP 22301, BCP Testing, COBIT/ITIL Governance, SDLC, Development and improvement of audit checklists according to ISO 27001, ISO 27007, and ISO 27008 requirements, Audit report and findings according to ISO 19011 and ISO 27006 standards, GAP Analysis for compliance with laws and DATA PRIVACY requirements (NIST, Local laws, GDPR...)...