At Company Certification Int., we provide expert conformity assessment services based on ISO/IEC 27037, the international guideline that outlines how to properly identify, collect, acquire, and preserve digital evidence. Though this is not a certifiable standard, our assessment helps organizations demonstrate alignment with best practices in digital forensics and incident response.

What Is ISO/IEC 27037?

ISO/IEC 27037 provides guidance on handling digital evidence in a legally sound and forensically reliable manner. It is especially valuable for organizations that may face legal disputes, security breaches, or need to collect evidence for internal investigations.

It covers:

• Identification and documentation of potential digital evidence

• Proper collection and preservation methods

• Role definition: Digital Evidence First Responders and Specialists

• Legal and procedural considerations in evidence handling

Our Assessment Services

Our ISO/IEC 27037 conformity assessment includes:

• Review of digital evidence handling policies and SOPs

• Evaluation of systems and tools used for data collection

• Gap analysis against ISO/IEC 27037 recommendations

• Assessment of staff readiness and role clarity

• Delivery of a Conformity Assessment Certificate

Key Benefits

• Increases the reliability of digital evidence in investigations

• Strengthens your organization's readiness for cyber incidents

• Supports compliance with data protection and legal standards

• Builds trust with regulators, auditors, and clients

• Reduces legal and reputational risk

Who Needs This?

• Organizations handling sensitive or regulated data

• IT and cybersecurity teams

• Legal departments and compliance officers

• Digital forensics and incident response units

• Government, telecom, finance, and healthcare sectors

What You’ll Receive

• Digital Evidence Handling Assessment Report

• Practical recommendations for improvement

• Certificate of Conformity (non-accredited)

• Optional awareness training for key staff

Our Process

• Conducted remotely or on-site

• Based on interviews, document review, and tool walkthroughs

• Efficient delivery with actionable insights

Frequently Asked Questions (FAQ)

Q1: Can we get certified to ISO/IEC 27037?
A1: No, it is a guideline. However, you can obtain a conformity assessment certificate showing your alignment with its principles.

Q2: Is this assessment useful for legal compliance?
A2: Yes. Proper digital evidence handling supports legal defensibility and readiness for disputes or cybercrime investigations.

Q3: How does it relate to ISO/IEC 27001?
A3: It complements ISO 27001 by offering depth in incident evidence collection and forensic practices, especially for security events.

Q4: Do you assess our team’s readiness?
A4: Yes. We review the roles, responsibilities, and preparedness of evidence handlers as defined in the standard.

Take Control of Your Digital Evidence Process

Let Company Certification Int. help you align with ISO/IEC 27037 and build confidence in your digital evidence practices.

Company Certification Int. offers professional conformity assessment services for organizations aiming to align with ISO/IEC 27035, the globally recognized guideline for managing information security incidents. While ISO/IEC 27035 is not certifiable, our structured assessment ensures your organization adopts best practices to effectively detect, respond to, and recover from security incidents.

What Is ISO/IEC 27035?

ISO/IEC 27035 is an international guideline designed to help organizations establish and maintain an effective Information Security Incident Management (ISIM) process. It includes guidance for:

• Preparing for incident handling

• Detecting and reporting incidents

• Assessing and responding to incidents

• Learning from incidents to improve the system

The current version (ISO/IEC 27035-1:2023) outlines principles and processes that align well with ISO/IEC 27001 and modern cybersecurity needs.

What We Offer

Company Certification Int. provides comprehensive conformity assessments that include:

• Independent review of your incident management policies and procedures

• Gap analysis based on ISO/IEC 27035 principles

• Evaluation of detection, response, and communication mechanisms

• Expert recommendations for closing identified gaps

• Issuance of a Conformity Assessment Certificate (non-accredited)

Key Benefits

• Improves cyber incident readiness and response

• Supports ISO/IEC 27001 implementation and audits

• Demonstrates commitment to global security standards

• Builds trust with clients, regulators, and stakeholders

• Identifies vulnerabilities and process improvement areas

Who Should Consider This Assessment?

• IT service providers and MSPs/MSSPs

• Financial institutions and fintech companies

• Healthcare, insurance, and government bodies

• Organizations managing personal, confidential, or regulated data

• Any business pursuing ISO/IEC 27001 certification or needing robust incident handling

Our Delivery Method

• Fully remote or hybrid assessment options

• Fast turnaround and flexible scheduling

• Secure digital reporting and documentation

What You’ll Receive

• Gap Analysis Report

• Recommendations aligned with ISO/IEC 27035

• Optional improvement roadmap

• Certificate of Conformity (3rd-party verified)

Frequently Asked Questions (FAQ)

Q1: Is ISO/IEC 27035 certifiable like ISO 27001?
A1: No, ISO/IEC 27035 is a guideline. It does not have certifiable requirements, but organizations can undergo a conformity assessment to show alignment.

Q2: What’s the benefit of a conformity assessment?
A2: It validates that your organization follows international best practices in security incident management and provides credibility in front of clients and partners.

Q3: Do I need ISO 27001 before doing this?
A3: No, but ISO/IEC 27035 complements ISO 27001 by covering incident management. It can be done as a standalone assessment or in support of ISO 27001 efforts.

Q4: Will you help improve our incident response process?
A4: Yes, we provide recommendations and, if needed, consulting services to enhance your processes based on the assessment findings.

Get Started

Let our team at Company Certification Int. help you assess, improve, and align your information security incident management process with ISO/IEC 27035.

Overview

ISO/IEC 27018 establishes privacy controls for public cloud Personally Identifiable Information (PII). Our assessment helps:

• Cloud Service Providers (CSPs) demonstrate PII protection compliance

• Data controllers verify cloud processor commitments

• Implement GDPR, CCPA and other privacy regulation requirements

• Complement ISO 27001/27017 certifications with privacy focus

Who It's For

• Public cloud providers processing customer PII

• Enterprises using cloud services for personal data

• Healthcare organizations with cloud-hosted PHI

• Financial institutions with cloud-based customer data

• Companies needing GDPR Article 28 processor compliance

Why an ISO 27018 Assessment Matters

• Regulatory Compliance: Meet key GDPR and global privacy requirements

• Customer Trust: Demonstrate verifiable PII protections

• Competitive Advantage: Differentiate privacy-conscious cloud services

• Risk Reduction: Identify gaps in cloud data protection

Scope of Our Assessment

• PII Processing Controls: Collection, use and retention policies

• Consent Management: User rights implementation

• Data Location & Transfer: Cross-border data flow protections

• Breach Notification: Cloud-specific incident response

• Third-Party Audits: Subprocessor compliance verification

Our 6-Step Assessment Process

1. Scoping Workshop: Define PII flows and cloud services

2. Document Review: Privacy policies and data processing agreements

3. Technical Evaluation: Encryption, access controls and logging

4. Provider Interviews: Privacy officers and cloud operations

5. Gap Analysis: Against ISO 27018 and regional privacy laws

6. Final Report: Conformity Assessment with remediation plan

Deliverables

• Conformity Assessment Certificate (valid 1 year)

• Privacy Protection Maturity Report

• GDPR Article 28 Compliance Checklist

• Data Subject Rights Process Review

• Executive Briefing Package

Why Company Certification Int.?

• Privacy Experts: Assessors with CIPP/E and CIPM knowledge

• Cloud Specialists: Deep experience with major cloud platforms

• Regulatory Knowledge: GDPR, CCPA, PIPL and other frameworks

• Global Acceptance: Recognized by international procurement teams

FAQ

Q: Is ISO 27018 certification available?
A: No, it's an implementation standard. Our assessment provides formal recognition of your compliance.

Q: How does this differ from ISO 27017?
A: 27017 covers general cloud security, while 27018 focuses specifically on PII protection.

Q: Can this help with GDPR compliance?
A: Yes, it addresses key GDPR processor requirements in Articles 28 and 32.

Q: What cloud services can be assessed?
A: All public cloud IaaS/PaaS/SaaS offerings processing PII.

Q: Do you interview our customers?
A: We can review customer-facing documentation and contracts.

Get Started

Ready to demonstrate cloud privacy compliance?
[Request Privacy Assessment] [Download Cloud Privacy Checklist]

Overview

ISO/IEC 27005 provides guidelines for information security risk management. Our assessment helps organizations:

• Evaluate risk management processes against international standards

• Identify gaps in cybersecurity risk identification and treatment

• Align with ISO/IEC 27001 requirements for risk assessment

• Improve decision-making for security investments

Who It's For

• Organizations implementing or maintaining an ISMS

• Risk management and compliance teams

• CISOs and information security managers

• Critical infrastructure operators

• Companies preparing for ISO 27001 certification

Why an ISO 27005 Assessment Matters

• Risk-Based Security: Prioritize security investments effectively

• Regulatory Compliance: Meet NIS2, DORA, and other cybersecurity regulations

• Stakeholder Confidence: Demonstrate mature risk governance

• Incident Prevention: Proactively identify security vulnerabilities

Scope of Our Assessment

• Risk Framework Evaluation: Methodology and processes

• Risk Identification: Asset, threat, and vulnerability analysis

• Risk Analysis: Likelihood and impact assessment

• Risk Treatment: Control selection and implementation

• Monitoring & Review: Risk reassessment processes

Our 6-Step Assessment Process

1. Scoping Workshop: Define risk assessment boundaries

2. Document Review: Risk management policy and procedures

3. Interviews: Engage with risk owners and security teams

4. Process Validation: Risk assessment walkthroughs

5. Gap Analysis: Compare against ISO/IEC 27005 guidelines

6. Reporting: Deliver Conformity Assessment with improvement plan

Deliverables

• Conformity Assessment Certificate (valid 1 year)

• Risk Management Maturity Report

• Implementation Roadmap

• Executive Briefing Package

Why Company Certification Int.?

• Risk Management Experts: Assessors with CRISC and ISO 27005 knowledge

• Sector-Specific Approach: Tailored for finance, healthcare, energy, etc.

• Practical Focus: Actionable recommendations, not just compliance

• Global Standards Alignment: Integrates with NIST, COBIT, and ISO 27001

FAQ

Q: Is ISO 27005 certification available?
A: No, it's a guidance standard. Our assessment provides formal recognition of your risk management alignment.

Q: How does this differ from ISO 27001 risk assessment?
A: ISO 27005 provides detailed methodology, while 27001 specifies requirements - we assess both.

Q: Can this integrate with our enterprise risk management?
A: Yes, we evaluate integration with overall ERM processes.

Q: What's the typical assessment duration?
A: 2-3 weeks depending on organization size and complexity.

Q: Do you help implement improvements?
A: Yes, we offer optional risk treatment implementation support.

Get Started

Ready to strengthen your cybersecurity risk management?
[Request Risk Assessment] [Download Risk Checklist]