Audit: articles and guides.
Every CloudSoul article on Audit, newest first.
ISO 27001 certification in Luxembourg: the process, accredited bodies, cost and local rules
ISO 27001 certification in Luxembourg works as it does everywhere: an ISMS, about three months of evidence and a two-stage audit by an accredited body. What is local: OLAS accreditation, the NIS2 law's reference to standards, and PSDC archiving status.
ISO 27001 surveillance audit: what happens in years two and three, how long it takes and what the auditor samples
An ISO 27001 surveillance audit happens at least once a calendar year, the first within 12 months of certification, and takes about a third of the initial audit time. What it must cover, what the auditor samples, and what happens when it goes wrong.
ISO 27001 and ISO 9001: what you can reuse, what is new, and how to run one integrated system
ISO 9001 and ISO 27001 share the Harmonized Structure, so a quality system already runs most of what ISO 27001 needs. What transfers, what is new (risk treatment, the SoA, 93 controls), how integrated audits and audit time work, and what ISO 9001:2026 changes.
ISO 27001 risk register: what it must contain, a template, and what auditors check
ISO 27001 requires every risk to have an owner, a level scored against your own criteria, a treatment, and the owner's acceptance of what remains. What the register must contain, a copyable template, and what auditors check first.
Does ISO 27001 make you secure? What a certificate proves, what it leaves open, and how to check one is real
Not on its own. An ISO 27001 certificate proves a certification body audited your management system for a stated scope. It does not prove the controls work well. What it proves, where it stops, and how to check a certificate is genuine.
ISO 27001 audit evidence: what auditors ask for, and how to collect it without the pre-audit scramble
ISO 27001 auditors sample dated records from across the audited period, not a snapshot taken the month before. What the standard requires as documented information, typical evidence per control area, how fast it goes stale, and how to collect it as the work happens.
ISO 27001 Stage 1 vs Stage 2 audit: what the auditor checks and what they accept
Stage 1 reads your ISMS documents to check the system is designed. Stage 2 tests whether it actually ran, after around three months of operation. What the auditor checks at each stage, what they accept, and what a major or minor nonconformity costs you.
ISO 27001 internal audit and management review: what clauses 9.2 and 9.3 require, how often, and what auditors check
ISO 27001 requires internal audits (9.2) and management reviews (9.3) at planned intervals. No frequency is set, but every certification visit checks both, so in practice they run at least yearly. What each clause requires, the seven review inputs and what auditors raise.
ISO 27001 without a security team: what a small company has to decide, build and run
A small company with no security team can pass ISO 27001, because it certifies a management system, not a security score. Who does what, the decisions only you can make, the documents and 93 controls, a nine-to-twelve-month timeline, and what the certificate leaves open.
NIS2 certification: is there a NIS2 certificate, and what counts as proof?
There is no NIS2 certificate for companies. NIS2 lets authorities require certified ICT products (Article 24), encourages standards such as ISO 27001 (Article 25) and audits entities (Articles 32 and 33). What exists, what is proposed, and what an auditor asks for.