Challenges
Using a mix of interviews, document reviews, and on-site observations, CyberGlobal assessed how well the company followed security policies and handled potential risks. The audit was performed in line with ISO/IEC 27001:2022, an international framework for managing information security.
The audit found:
- 0 major non-conformities (meaning there were no serious compliance issues)
- 2 minor non-conformities
- 4 opportunities for improvement
Key findings included:
| Lack of AI Usage Policy | The company had no official policy on the use of Artificial Intelligence tools like ChatGPT. Such tools can improve efficiency but also create privacy risks if sensitive data is shared unintentionally. |
| Missing Information Asset Inventory | There was no complete inventory of information assets, meaning the company lacked a detailed list of what data and systems it owned and how they were protected. |
| Insufficient Access Controls | Access controls could be improved to ensure that only authorized staff can handle specific data. |
Solutions
After the audit was completed, CyberGlobal provided several practical recommendations to strengthen the company’s security framework. These steps would help the company maintain a culture of awareness and readiness while improving long-term data protection.
- Conduct regular simulations of incidents (for example, a ransomware attack) to make sure all employees know their roles during a crisis.
- Perform internal self-assessments to verify compliance with ISO/IEC 27001 standards and verify that all security controls are up to date.
- Review and update policies annually, clearly documenting who approved them and what changes were made.
- Include emerging risks, such as the use of AI tools, when updating risk assessments.
Results
Overall, the audit confirmed that the company maintains a strong level of compliance with ISO/IEC 27001:2022. However, continuous improvement remains a priority, with plans to implement a Data Loss Prevention (DLP) strategy, conduct new penetration tests, and deliver advanced security training for developers.
Strengths identified include:
- Employees show strong commitment to maintaining high security standards.
- Legal and contractual requirements are well understood and applied.
- Vendor and risk management processes are thorough and well-documented.
The audit showed that the company is taking a proactive approach to security, focusing not only on compliance, but also on building a culture of trust and accountability in handling sensitive health data.