Executive Summary
Regulated financial services firms must demonstrate information security governance to customers, partners, and supervisors. This case study covers how CyberSigma helped a BFSI platform (client name withheld under NDA) build an audit-ready ISMS and close critical gaps before certification.
Client Overview
The client is a financial services technology platform serving regulated institutions in India. Rapid product growth outpaced security documentation, leaving certification and procurement reviews at risk.
- Industry: BFSI / Financial Services
- Region: India
- Scope: ISO 27001 ISMS — cloud & on-prem workloads
Challenge
Fragmented policies, unclear asset inventory, and immature risk treatment left the organisation unprepared for ISO 27001 certification and regulator scrutiny.
- No unified ISMS scope or Statement of Applicability
- Incomplete asset inventory and data classification
- Weak access reviews and logging evidence
- Vendor risk assessments not standardised
- Internal teams lacked certification rehearsal experience
Objectives
- Define ISMS scope, SoA, and risk treatment plan
- Assign control owners and evidence collection cadence
- Remediate high-priority technical and process gaps
- Prepare for Stage 1 and Stage 2 certification audits
- Enable faster enterprise procurement cycles
Our Approach
1. ISMS Scoping & Risk Assessment
We defined boundaries, assets, and risk scenarios aligned to business context—producing a risk treatment plan leadership could approve.
2. Control Design & SoA
Annex A controls were mapped with clear applicability, owners, and implementation guidance tailored to the platform architecture.
3. Gap Remediation
Priority fixes across access management, logging, backup validation, and vendor due diligence were tracked to closure.
4. Internal Audit Rehearsal
Mock audits and evidence walkthroughs prepared teams for external assessor interviews and reduced certification surprises.
Solution
- Defined ISMS scope, SoA, and risk treatment aligned to business context.
- Implemented control owners, evidence cadence, and internal audit rehearsal.
- Completed gap remediation across access, logging, and vendor risk.
- Delivered certification-ready documentation packs.
Results
- Audit-ready ISMS package delivered in 12 weeks
- 87% reduction in critical and high findings after remediation
- Faster procurement wins with demonstrable security governance
- Sustainable control operations for annual surveillance audits
Timelines and outcomes reflect the documented engagement record for this client; results vary with scope and readiness.
What We Delivered
- ISMS scoping and Statement of Applicability against the 2022 Annex A
- Risk assessment and treatment plan
- Policy/procedure set and control implementation across the four themes
- Internal audit and management review ahead of certification
- Certification-audit coordination through stage 1 and stage 2
The standard artefact set for this engagement type; per-client environment and architecture details are shared under NDA during procurement, not published.
Lessons Learned
- The 2022 transition items (threat intelligence, cloud services, DLP, secure coding) were where legacy documentation failed — new controls needed implementation, not re-mapping.
- An honest risk assessment kept the SoA defensible; exclusions justified by risk survived audit, exclusions justified by convenience did not.
- Internal audit run properly before stage 1 converted certification from an examination into a confirmation.
Talk to the team that ran this engagement
This was a real ISO 27001 Certification Consulting engagement. If you are preparing for the same, speak to a specialist who has delivered it — not a sales rep. We will give you a clear read on your scope, gaps and the fastest path, and reply within four business hours.
Explore ISO 27001 implementation · more case studies
Liked the case study? Share on: