Build trust across security, privacy & compliance

Challenge

Information about vulnerable individuals required careful handling, clear accountability and alignment with applicable legal requirements across several stakeholders.

Work delivered

• Workshops on GDPR, Tunisian Organic Law No. 2004-63, processing roles and secure handling of sensitive information
• Assessment of governance, processing activities, procedures, responsibilities and compliance gaps
• Prioritized recommendations tailored to civil society operations
• Data protection procedures manual covering data lifecycle, access, confidentiality, incidents, retention and internal governance
• Article 35 assessment: processing context, GDPR principles and rights, and risk scenarios

Outcome

A sequenced plan assigned practical measures across governance, organizational practice, technical safeguards, and risk and incident management. Modeling found no maximal residual risk after the proposed measures; high-impact scenarios remained significant and were rated honestly.

Audit approach

• ISMS documentation review and interviews with key personnel
• Observation of operational practices and technical verification of selected controls
• Risk-based sampling of evidence
• Seven areas reviewed: asset management, endpoint security, access control, supplier management, business continuity, security awareness and organizational governance
• Representative tests included Intune-managed encrypted endpoints, backups, Teams and Outlook, supplier assessments, DPIAs and risk management

Results

The ISMS was assessed as effective, with continuing conformity to ISO/IEC 27001:2022. The audit found zero major and zero minor nonconformities, and two observations. Strengths included mature governance, access management, lifecycle practices and incident response. Recommendations addressed tool consistency, incident handling efficiency, privacy impact reporting and alignment between operational practice and documentation.

Assessment

• Reviewed ISMS documentation, interviewed management and process owners, and sampled operational evidence
• Assessed mandatory clauses and applicable Annex A controls
• Covered governance, risk management, suppliers, business continuity, access, improvement, security operations, monitoring, vulnerabilities, incidents and security assessment

Findings

The audit confirmed a solid ISMS foundation, established governance and largely aligned policies. It identified two major nonconformities, six minor nonconformities and 17 opportunities for improvement. Priority actions included improving traceability between assets, risks, treatments and controls, and formalizing management review records. Further recommendations covered operational evidence, continuity testing, supplier governance, monitoring and Annex A documentation.

Outcome

Management received an independent maturity assessment and a clear, risk-prioritized improvement roadmap to strengthen governance, audit evidence and readiness for the external certification audit.