Cybersecurity audit and consulting: ISO 27001, NIST CSF and pentesting

We audit and structure information security from risk towards control: first we understand what keeps the operation running, which processes cannot stop and which information cannot be lost; on that basis we build a security posture that is proportional, measurable and sustainable.

The problem this service solves

Every organization now depends on information systems in order to operate, whatever its size or degree of digitalization. That makes cybersecurity a matter of business continuity rather than a purely technical topic: an incident halts the operation, compromises sensitive information, exposes the company to regulatory penalties and erodes the trust of clients and partners.

The most common mistake is buying tools before understanding the risk. A corporate antivirus goes in, a next-generation firewall is contracted and a monitoring license is paid for, but nobody defined which assets are critical, who has access to what, or what happens the day the main system does not start. The result is spending without a security posture.

The other extreme costs just as much: locking things down so tightly that the operation stops flowing. A policy the staff cannot comply with ends up being worked around, and a control that slows production down is switched off at the first emergency. Security that works is security the organization can sustain.

Scope of service

• Cybersecurity maturity assessment — analysis of the maturity level against reference frameworks (NIST CSF, ISO/IEC 27001, CIS Controls), with mapping of critical assets and processes, assessment of the existing controls, gap analysis and a prioritized remediation roadmap with an investment estimate, scaled to the real size and capacity of the organization.
• Infrastructure and network security audit — technical review of the network architecture, segmentation, access control, configuration of servers, endpoints and perimeter devices, and the exposure of services on the internet and in the cloud, checked against hardening baselines and known attack vectors.
• Penetration testing (pentesting) — controlled simulation of attacks to identify exploitable vulnerabilities before a third party does: internal and perimeter infrastructure, web and mobile applications, cloud services, wireless networks, social engineering and red team exercises.
• Security policy and governance design — a complete governance framework: policies, procedures, incident response plan, continuity plan (BCP/DRP), risk matrices, third-party management and definition of roles and responsibilities, aligned with the regulatory requirements that apply given the activity and the jurisdiction.
• Training and awareness — training differentiated by audience: general awareness for all staff, technical training for the technology and operations teams, and tabletop simulation exercises for senior management. Controlled phishing campaigns with response metrics, improvement indicators and reinforcement plans.
• Monitoring and incident response — design and implementation of detection and response capabilities: selection of SIEM/SOAR and EDR tools, monitoring use cases, response playbooks, detection and containment metrics, and agreements with internal or external CSIRT teams.

Reference frameworks

• ISO/IEC 27001
• NIST CSF
• CIS Controls
• ISO 22301
• OWASP
• IEC 62443
• NIST SP 800-82
• CSA CCM

To those frameworks you add whichever personal data protection rules apply to the organization —in Colombia, Law 1581 of 2012— and the sector standards the client environment demands, such as PCI DSS in payments, or IEC 62443 and NIST SP 800-82 in industrial control.

One important clarification

Auditing is not certifying. ISO/IEC 27001 certification is issued by an accredited, independent certification body; no consultancy can issue it or guarantee it. What we do is assess, design and implement the system and support you all the way to the certification audit.

And one condition that is not negotiable: every penetration test is carried out with written authorization from the owner of the systems, with scope, execution window and emergency contacts agreed in advance. In continuously operating environments —a substation, a plant— the scope is limited to non-intrusive techniques, because the aim is to find the vulnerability, not to cause the outage you are trying to prevent.

Audit scope matrix

Industrial environments and critical infrastructure

This is where this line of work meets the rest of what we do. Auditing an office network and auditing a substation network are not the same job: in operational technology (OT) the priority is not confidentiality but availability, equipment has been in service for years with no way to patch it, and a badly executed port scan can take a control device offline.

That is why the scope in these environments is built differently: passive asset inventory, review of the segmentation between the corporate network and the control network, analysis of the remote access routes used by manufacturers and contractors, and verification of the architecture against IEC 62443 and NIST SP 800-82. Active testing, where there is any, is agreed in writing and executed during shutdown windows.

How we work

1. Scope. Definition of assets, critical processes and applicable regulatory frameworks. This is where it is agreed what will be tested, what is out of scope and under what conditions, and it is put in writing before anything is touched.
2. Reconnaissance. Mapping of the attack surface, asset inventory and topology. Systems nobody had on the list almost always turn up: it is one of the most valuable findings of this phase.
3. Assessment. Technical testing, vulnerability analysis and verification of controls. What gets verified is what the control does, not what the procedure says it does.
4. Report. Findings, risk classification and remediation roadmap. Prioritized by real risk and by effort, not a flat list of 300 vulnerabilities in no particular order.
5. Remediation. Technical support in implementing the controls and re-testing what was fixed. A finding is not closed because someone says they fixed it, but because it is tested again.

What the client receives

• Maturity assessment report with current level, gaps and target per domain.
• Asset inventory and attack surface map.
• Technical findings report with evidence, risk classification and impact on the operation.
• Executive summary for management, in business language rather than console output.
• Prioritized remediation roadmap, with owners, estimated effort and investment estimate.
• Governance documentation: policies, procedures, risk matrix and incident response plan.
• Re-test report for the closed findings.

Questions clients ask us most

Can a pentest take our operation down?

Not if it is properly set up. Scope, window and techniques are agreed beforehand, and in continuously operating environments we work with non-intrusive methods. The real risk is not the authorized test: it is the vulnerability still open because nobody wanted to look at it.

Where do we start if we have nothing in place?

With the maturity assessment. Without knowing which assets hold up the operation and which controls really exist, any investment in tools is a bet. The diagnosis usually shows that several gaps close with configuration and procedure, without buying anything.

Does this leave us certified in ISO 27001?

No, and be wary of anyone who promises it. Certification is granted by an independent accredited body. What you do get is the management system implemented and working, and support all the way to that audit.

← Back to all services · Related: Telecontrol & SCADA · HSEQ Consulting