Ethics
Will Trygg help us look compliant, or be compliant?
A security program rests on two kinds of trust.
The record has to be true. The information is accurate and complete, and the work does what it is supposed to do.
The people keeping that record have to tell the truth about it.
Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
What the frameworks ask for
ISO/IEC 27001 has no clause titled Ethics. Information security in this standard means confidentiality, integrity, and availability. Integrity means the information is accurate and complete.
Clause 5.1 asks leadership to show that the program matters and that people are expected to follow it.
Clause 9.2.2 asks internal auditors to stay impartial. Auditors do not audit their own work.
A.5.3 Segregation of duties keeps one person from controlling a sensitive action from start to finish.
A.5.35 Independent review asks someone outside the day-to-day work to look at whether the program is operating as intended.
ISO/IEC 17021-1 keeps the firm that builds a management system separate from the firm that certifies it.
SOC 2 is the framework that says the word. Trust Services Criterion CC1.1, from COSO Principle 1, expects a commitment to integrity and ethical values: the tone at the top, the standards of conduct, and a response when people depart from them.
Processing Integrity sits beside that commitment. Processing is complete, valid, accurate, timely, and authorized.
NIST Cybersecurity Framework 2.0 puts Govern first: context, roles, policy, and oversight. Accountability and leadership ownership carry the ethical duty.
Bruce Schneier, in Liars and Outliers: Enabling the Trust that Society Needs to Thrive, makes the same point. Security exists so people can trust one another.
CMMC is a set of practices for protecting controlled information. If you hold another organization's sensitive information, you protect it as promised, and you can show the practice you claim.
Privacy law treats fairness, purpose, and transparency as obligations. Trygg does not provide legal advice.
Professional codes such as (ISC)² and ISACA ask practitioners to protect society and act honorably.
What we believe
Trygg treats a hidden gap as a bigger problem than a visible one.
We state what we can do, and we say when a question belongs to a lawyer or an auditor.
An independent certification body makes the certification decision. Trygg helps you build the management system.
How the portal supports that
Scores come from the systems that do the work, and each result shows the date the evidence was last refreshed.
Exclusions are stated, not buried.
Every control has a named owner. Leadership and the auditor see the same underlying information.
A.5.33 Protection of records keeps the date and the history of that evidence.
Portal demos follow a mutual NDA.
Trygg means trustworthy
Trygg is the confidence of knowing things are taken care of.
The name is on About. How we keep records is on Trust Trygg. The line between building the system and certifying it is on Certification.