Trygg. Safe Today. Stronger Tomorrow.
Menu
Book a demo

How It Works

How it works is three phases of implementation, starting with the ISO standard.

The ISO standard

We follow ISO standard methodology driven by the following clauses:

  • 4

    Context of the organization

    The scope, the people affected, and the management system the rest of the work is built on.

  • 5

    Leadership

    Commitment from the top, a policy, and a named owner for the work.

  • 6

    Planning

    Risks, objectives, and how changes will be handled.

  • 7

    Support

    The people, awareness, communication, and documents the system needs.

  • 8

    Operation

    The system the organization is using, including risk assessment and risk treatment.

  • 9

    Performance evaluation

    Monitoring, internal audit, and management review. This is how the organization is measuring.

  • 10

    Improvement

    Continual improvement and corrective action. This is how the organization is improving.

The 12-week implementation

Twelve weeks, organized into six focused sprints. Each sprint has a clear objective and a tangible result, moving you from initial scope to an operating ISO/IEC 27001 management system. Engagement Options shows how we offer different implementation options.

Our 12-week process establishes the foundation that every implementation starts with. You set the pace.

  1. Weeks 1 through 2

    Kickoff and Scope

    We establish what is in scope, what information needs to be protected, and which parts of the organization are involved. The Taxonomy explains our foundation: the reference data the rest of the program is built on. We review your existing Statement of Applicability, risk register, systems, and business processes. At the end of the sprint, the boundaries of the program are clear and the right leaders are identified.

  2. Weeks 3 through 4

    Gap Analysis and Project Plan

    We compare ISO/IEC 27001 requirements with what your organization already does. Existing practices are preserved where they work, and gaps are identified in plain language. You leave with a prioritized plan showing what needs to be created, improved, connected, or demonstrated.

  3. Weeks 5 through 6

    Policies, Processes, and Ownership

    Policies and processes are created or brought up to date, and every in scope control is assigned to a named leader. Control leaders review what applies to their area and confirm how the work is actually performed. At the end of the sprint, expectations and accountability are clear.

  4. Weeks 7 through 8

    Connect the Evidence

    Trygg begins connecting the management system to the technologies that operate your security program. Identity, email, endpoints, backups, and other available systems begin feeding evidence into the portal. Leadership can now see actual control results, supporting evidence, and when that evidence was last refreshed.

  5. Weeks 9 through 10

    Training and Awareness

    Control leaders learn what they own, what is expected, and how their responsibilities are demonstrated in Trygg. Employees receive the security awareness training appropriate to their roles. Completion is tracked in the portal, making it clear who is ready and where follow up is still required.

  6. Weeks 11 through 12

    Readiness and Operational Handoff

    We walk through the management system the way leadership and an auditor will see it. Scope, risks, controls, processes, evidence, training, and open items are reviewed together. You leave with Trygg in active use, clear ownership across the program, and visibility into what is ready, what remains open, and what happens next.

How we work together

  1. Aligned with your business

    We want this program to be a priority. It starts with your business goals, your strategy, and how your organization will adopt it. The work we do together has to line up with those.

  2. Three roles

    The portal shows what is complete, what needs attention, and who owns it. Trygg helps you build the system, connect the evidence, and stay in the way you choose on Engagement Options. Your leaders own the controls and the decisions. An independent certification body decides certification.

  3. How progress is reviewed

    At the end of each sprint, and once Trygg is in use, the portal shows progress against the Taxonomy. You can see what is done, what is still open, who has it next, and that the work still lines up with that structure.

  4. After the twelve weeks

    Evidence keeps a date. Owners stay named. Reviews continue. On Engagement Options, we maintain it with you, or we hand it to your team and stay available.

What progress looks like

A backup control is in scope. The connected system shows the last successful test is past the date the process requires. The portal shows the gap, the leader who owns the control, and the evidence date. That leader has the action. When the test is done, the new result replaces the stale date. At the next review, you and Trygg are looking at the same completed item.

The internal audit

This is the internal audit inside the engagement. Every implementation receives the attention it deserves.

  1. 1

    Clarify Scope

    Define Boundaries

    Identify what systems, processes, and controls will be included in this audit cycle.

  2. 2

    Plan & Confirm

    Set Objectives

    Establish clear audit goals, criteria, and timeline aligned with ISO 27001 requirements.

  3. 3

    Communicate Plan

    Inform Stakeholders

    Share the audit plan with all relevant parties before execution begins.

  4. 4

    Gap Assessment

    Execute Pre-Audit

    Conduct thorough review to identify compliance gaps and areas needing improvement.

  5. 5

    Remediate & Verify

    Close the Gaps

    Rank findings by risk, assign owners, complete corrective actions, and confirm gaps are closed before audit handoff.

  6. 6

    Evidence & Report

    Document Results

    Organize supporting artifacts and complete the internal audit report so findings and evidence are ready for leadership and external audit.

At the end of twelve weeks, you do not receive a binder.

You have an ISO/IEC 27001 management system your organization is using, measuring, and improving.

Book a demo