An ISMS that runs after the certificate. Not just until it.
Most ISO 27001 programmes decay the moment the auditor leaves. Softenger operates your ISMS continuously — risk register ownership, surveillance readiness, and board reporting — so your certification reflects your actual security posture, every day of the year.
Each requirement from each framework is mapped once onto a single control base. One control, one piece of evidence, several frameworks answered.
Your team stops running six parallel compliance programmes. You run one ISMS and report against whichever framework is asking.
ISO 27001:2022 Annex A has 93 controls across four themes: organisational, people, physical, and technological. Every one is assessed for applicability.
Any control that doesn’t apply is excluded in the Statement of Applicability, with a written justification an auditor can read.
Assessment — a gap analysis against the standard. Implementation — we build the ISMS to audit-ready.
Managed Ops — we run the ISMS day to day. Embedded Lead — a Softenger ISMS lead works inside your team.
You can start with one and move to another as your needs change.
The timeline depends on organisation size, the number of frameworks in scope, and how much documentation and evidence already exists.
{{PLACEHOLDER: one line on what “production-ready” means in practice, e.g. controls live, evidence collection running, first review cycle scheduled}}
Certification is not the problem. What happens after it is.
The Post-Certificate Decay
Most organisations certify once — and then the ISMS quietly degrades. By the time the surveillance audit arrives, the risk register is stale, evidence is missing, and the programme no longer reflects how the business actually operates.
No One Owns the Risk Register
Risk assessments get completed for the audit. Then they sit. Nobody is assigned treatment SLAs, escalation paths, or accountability for what happens to the 40 risks identified before the certificate was issued.
Per-Framework Audit Paralysis
ISO 27001, SOC 2 Type II, GDPR, HIPAA, RBI — each framework triggers a separate preparation exercise, consuming internal teams for months per cycle. The same controls, verified four times over in four different formats.
GRC Tools Without People
Organisations invest in GRC platforms and find the evidence still doesn’t collect itself. The tool organises the work; it doesn’t do it. Without dedicated operators, the platform becomes an expensive folder structure.
The Certify-and-Leave Consultant
The audit passes. The consultant invoices and moves to the next client. Your ISMS now depends entirely on internal staff who were briefed for three months but never trained to run it. The programme starts decaying immediately.
Regulation is Not Standing Still
DPDP Act, NIS2, updated CERT-In directions, RBI IT examination cycles — the regulatory landscape governing information security changes every year. An ISMS built for 2022 requirements needs continuous adaptation, not a three-year wait for recertification.
We don’t certify you and leave. We run the programme.
Before we write a single policy, we assess your risk landscape, your regulatory obligations, and what your certification body will actually scrutinise. We don’t apply generic ISO 27001 templates to complex enterprises.
Our model runs end-to-end: gap assessment, ISMS build, certification support, and then — critically — ongoing managed operations. Every risk in the register has a named owner and a treatment SLA. Evidence is collected continuously, not assembled in a pre-audit scramble.
Because Softenger is ISO 27001:2022 certified ourselves, we run our clients’ ISMS the same way we run our own — with the accountability of an operator, not the detachment of a consultant.
- ISMS that keeps running — continuously operated, not quarterly-reviewed
- Risk register with named owners, treatment SLAs, and escalation paths
- One control set mapped across six frameworks — evidence collected once
- Board-ready posture reporting without internal effort
- Surveillance-audit readiness from day one of managed operation
- A certificate on the wall — with a programme that decays behind it
- Policies written for the auditor, not for the business
- Risk register completed once, never assigned, never tracked
- Per-framework re-runs consuming months of internal time
- A handover deck that no one has capacity to action
One ISMS. Every framework you answer to.
The largest hidden cost of compliance isn’t the audit — it’s the preparation. Most organisations run separate evidence-gathering exercises for each framework they’re obligated to. We build one control set and map it across all of them.
ISO 27001 Annex A overlaps significantly with SOC 2 Trust Service Criteria, GDPR Article 32, and HIPAA Technical Safeguards. One governance infrastructure satisfies all four — evidence collected once, mapped automatically across every mandate.
Evidence collected once, satisfied across all mandates
A single internal audit record contributes to ISO 27001, SOC 2, and GDPR simultaneously — no duplicate preparation cycles per framework.
~60% reduction in audit preparation effort
Pre-audit prep shrinks to verification — not re-creation. One control set, one evidence trail, mapped to every framework you answer to. {{PLACEHOLDER: verify with client data}}
Regulatory change built into operations, not chased at audit
DPDP Act, NIS2, updated CERT-In directions — monitored continuously and incorporated before they affect your next certification cycle.
Four stages of an operated ISMS — from gap to certification to continuity.
Every deliverable, every output, documented at each stage. This is what you commission when you engage Softenger for information security management.
Assess & Scope
Understand actual risk and real obligations before any documentation begins. Most failed ISMS programmes started with policies before they understood their own scope.
- Gap assessment against ISO 27001:2022 Annex AControl-by-control review with owner, current-state scoring and recommendations
- ISMS scope definition documentAssets, boundaries, processes and interfaces in scope — agreed with your leadership
- Risk assessment and treatment planRisk register with identified threats, likelihood, impact, and proposed treatment options
- Compliance obligation mapAll active frameworks mapped to your ISMS scope — ISO 27001, DPDP, GDPR, or others
Deliverable: Prioritised roadmap and agreed scope — before a single policy is written
Build
An ISMS architected to your business — not a template forced to fit. Every policy, procedure, and control is mapped to how your organisation actually operates.
- Information Security Policy and procedure suiteFull documentation library aligned to your operations and ISO 27001
- Statement of Applicability (SoA)All Annex A controls assessed, included or excluded with documented justification
- Annex A control implementationControls across the organisational, people, physical, and technological domains
- Security awareness training programmeRole-based training covering mandatory ISO 27001 awareness requirements
Deliverable: Certification-ready ISMS documentation that reflects how you actually operate
Certify
Walk into the external audit ready — with evidence already collected, internal audits completed, and no last-minute documentation scramble. Your certification body sees a functioning ISMS, not a prepared one.
- Internal audit programmeStructured audit schedule with findings, corrective actions, and management review inputs
- Management review facilitationAgenda, inputs, outputs, and minutes prepared and facilitated for CISO/leadership sign-off
- Pre-certification evidence packComplete documentation package organised to match your certification body’s audit process
- Certification audit supportOn-site or remote support through Stage 1 and Stage 2 audits, including NCR response
Deliverable: Certification achieved with zero major non-conformities at audit
Operate
The part everyone else skips. We run your ISMS between certifications — so the programme stays true, the certificate stays meaningful, and your board sees a real security posture, not a framed document.
- Continuous risk register managementEvery risk assigned an owner with a treatment SLA — no item left open indefinitely
- Surveillance-audit readiness, every cycleEvidence collected and maintained throughout the year — not assembled in the week before
- Board-ready ISMS reportingMonthly posture reports and quarterly management review packs — ready without internal effort
- Regulatory change monitoringDPDP, NIS2, CERT-In updates tracked and incorporated before they affect your next audit
Deliverable: Continuously certified — not certified once and scrambling at surveillance
From advice to operation — your information security programme.
Every Softenger engagement runs on the same four phases. For ISMS, AOTS maps directly onto the ISO 27001 Plan-Do-Check-Act cycle — the difference is that we stay for all four phases, not just the first two.
Phase 01 · PlanAdvise
Risk and obligation before policy.
- ISMS maturity and gap assessment against ISO 27001:2022
- Risk assessment, threat identification, treatment planning
- Compliance obligation mapping across all active frameworks
A prioritised roadmap and defined scope — before a single policy is written.
Phase 02 · DoOptimize
One control set, many frameworks.
- Reuse existing controls — eliminate per-framework duplication
- Assign and close risk register items before they age
- Internal audit programme stood up and running
Evidence collected once, mapped across every mandate — far less duplicate effort.
Phase 03 · CheckTransform
Build the certifiable ISMS.
- Policies, procedures, and Statement of Applicability complete
- Pre-certification evidence pack assembled and reviewed
- Certification audit support — Stage 1 and Stage 2
Certification-ready ISMS that reflects how the business actually operates.
Phase 04 · ActSupport
Keep it true between audits.
- Continuous evidence collection and surveillance readiness
- Board-ready posture reports and management review packs
- Regulatory change monitoring — DPDP, NIS2, CERT-In updates
Continuously certified — because someone is operating the programme every day.
AOTS is a continuous cycle — not a one-time project.
Once your ISMS completes its first AOTS lifecycle, it re-enters Advise with a richer baseline. Every cycle shortens the time to compliance and extends your security posture maturity.
- A — Advise
- O — Optimize
- T — Transform
- S — Support
Why CISOs hand us the ISMS — not just the audit.
Six reasons information security leaders choose an operator over a consultant.
Governance tuned to the regulators you answer to.
The same ISMS, mapped to the frameworks and supervisors specific to your sector — not a generic template relabelled for your industry.
BFSI
ISO 27001 mapped to RBI and SEBI cyber-security frameworks, plus PCI-DSS for payment environments. One governance structure satisfying both regulators.
Healthcare & Pharma
HIPAA and GxP-aligned ISMS for PHI and clinical-system governance across distributed sites. DPDP-ready for India operations.
IT & SaaS
ISO 27001 plus SOC 2 Type II readiness — the evidence enterprise customers demand before they sign. One control set satisfying both.
E-commerce & Retail
PCI-DSS and data-protection governance for high-volume payment and customer-data environments. DPDP readiness for India-facing operations.
Manufacturing
ISMS spanning IT and OT, with supply-chain and ICT-supplier controls under ISO 27001:2022 Annex A — specifically the new 5.19–5.22 supplier controls.
EdTech
Student-data protection and DPDP-ready governance for fast-scaling cloud-native platforms where enterprise client data-security questionnaires are a sales requirement.
Government & Public Sector
CERT-In aligned ISMS with the documented evidence trail that public-sector audits require. Policy built to the standard; operations held to it.
Power & Utilities
Security governance for critical infrastructure aligned to sector regulation and ISO 27001 — with OT-aware scope definition and supplier controls covering ICS environments.