Our services

The "Information Systems Audit" service assesses the current state of the organization's information security in terms of data protection by applying best practices in information security management in accordance with the requirements of the Cybersecurity Act, the Regulation on Minimum Requirements for Network and Information Security, ISO/IEC 27001, ISO/IEC 27002, NIST, PCI-DSS, etc.

The main objectives of the IT audit are:

Determine whether IT services meet best practices and applicable regulatory and other requirements;

to determine whether the information and communication infrastructure in place is capable of supporting all processes taking place in the organisation;

determine the effectiveness of IT services;

assess the competence of IT staff to perform their information security duties;

minimise the risk of damage, loss and theft of information resources/data.

The information security analysis considers the physical and logical protection of assets and data, administration and access levels, information security policies, and business continuity assurance and contingency, disaster and emergency planning.

Stages of an IT audit:

1. Audit planning

Preparing an audit plan and defining a team;

Preliminary meeting to familiarise the organisation with the initial audit plan and team. Determine strategies and objectives for the audit;

Identification of information and communication assets and the organisation's sites to be audited;

Review and adjust the audit plan based on the risk assessment performed.

2. Audit implementation

Assess the effectiveness of the information security controls implemented by the organisation;

assessment of communication and network security;

security assessment of core and web-based applications;

database security assessment;

security assessment of core server systems and the services they provide;

analysis of the control mechanisms used

scanning for vulnerabilities and potential information security threats to publicly available systems and applications.

3. Preparation of a report
The IT audit ends with the preparation of a detailed report containing all the findings and possible improvement measures. The final report includes:

An assessment of the efficiency of the processes being carried out in the organisation;

identified risk factors;

suggestions for corrective and preventive actions to ensure the effective and secure functioning of the applications and systems in the organisation.

Benefits to the organization of conducting an IT audit:

Ensuring better and timely protection of key information assets;

Building a systematic approach and accurate prioritization in designing, planning and budgeting the required changes to the IT infrastructure;

drawing up a specific work programme to improve information security, taking into account the gaps and vulnerabilities identified in the communication and information systems in use;

achieving fuller compliance with information security regulatory requirements;

maintaining reliable communication with all stakeholders and improving security when working with partners.

The results of the IT audit help to add value and increase the credibility of the organisation, while ensuring compliance with regulatory bodies and information security standards. The report's findings and recommendations aim to improve security and optimise the organisation's IT environment.

The implementation and subsequent successful certification of a Management System in your organization is by no means the last step on the path to improvement and continuous improvement - it is also necessary to maintain what has been achieved. As for Management Systems, their maintenance depends both on the commitment of the Management and employees, and on periodic checks for compliance with the requirements of the implemented standards. These checks are called internal audits.

CONSEJO offers as a separate service the performance of an internal audit of management systems (MS) according to standards ISO 9001, ISO 14001, ISO 20000-1, ISO 27001, ISO 28000, ISO 45001, ISO 50001, ISO 22000, IFS, BRCGS, ISO 17020, ISO 17025, etc.
The service "Performing an internal audit of the University of Sofia" is performed by our experts who have many years of experience in developing and maintaining management systems. They are discreet, diplomatic, impartial and ethical during the audit process.

The service includes:

planning the conduct of an internal audit (preparation and coordination of the "Audit Program");

review of the documentation of the management system (Manual, policies, procedures, instructions, operational documents);

performing an Internal Audit (interviews with employees; observations of the processes in the company; review of documented information);

disclosure of the results of the audit and preparation of a Report describing the findings and/or recommendations made.

Option:
If necessary and after additional agreement between the two parties, we offer assistance and consulting services related to:

recommendations for improving the efficiency of the management system;

updating the documentation of the Management System;

conducting training;

consulting and assistance during second/third party audits;

elimination of identified non-conformities, etc.

For more information about the service "Performing internal audit of management systems" you can contact us.

The management standard implementation service, performed by "ISO STANDARDS" EOOD, includes establishing the current business model, developing and implementing Management Systems (MS) and Integrated Management Systems (IMS) according to any of the following standards or schemes:

ISO 9001

ISO 14001

ISO 20000-1

ISO 22000

ISO 27001

ISO 28000

ISO 45001

TISAX

SOC-2

NIST

IFS Food

GMP

GDP

etc.

STAGES OF DEVELOPMENT AND IMPLEMENTATION OF MANAGEMENT SYSTEMS (MS) until obtaining a certificate according to various standards:

STAGE 1 Status Review (GAP Analysis):

review of the status of the operating system for compliance with the requirements of the specific standard;

analysis of the status and determination of the structure of the Management System;

development of a Schedule for the implementation of the development and accompanying documents - orders, programs, etc.

STAGE 2 Development of MS documents:

development of Management System documents - procedures, operational documents / forms, manual, etc.;

acceptance of documents by joint working teams.

STAGE 3 Implementation:

conducting theoretical training;

conducting implementation training;

conducting trial internal audits;

making changes to documents if necessary during audits.

4 STAGE Operation:

conducting training for internal auditors;

conducting internal audits.

5 STAGE Certification and certificate acquisition:

(performed by a certification organization*)

participation in the selection of a certification organization and during the certification audit;

removal of any audit findings.

* The certification body is always an independent third party - a Bulgarian or foreign legal entity duly accredited to carry out certification activities. Consulting and certification activities cannot be carried out by the same organization or by related organizations.

* CONSEHO works with all certification organizations and guarantees successful certification, regardless of the choice of the certification body.

Preparation for accreditation of control bodies and laboratories according to ISO 17020 and ISO 17025. Preparation for accreditation

ISOSTANDARDTS carries out preparation for accreditation of:

calibration and testing laboratories according to the international standard ISO 17025;

control bodies according to the international standard ISO 17020;

medical laboratories according to the international standard ISO 15189.

Accreditation is part of a comprehensive system, including conformity assessment and market surveillance, designed to assess and ensure compliance with applicable requirements. The special importance of accreditation is based on the fact that it provides official certification of the technical competence of conformity assessment bodies.

What are the benefits of implementing a management system?

For accredited conformity assessment bodies (laboratories, control bodies, certification bodies):
they become an important part of the quality infrastructure in the country;

they guarantee high quality of the services they provide (testing, calibration, control, certification);

the implementation of a management system and subsequent granting of accreditation by a national accreditation body (for Bulgaria such a body is the BSA EA) is proof of the competence of the laboratory/control body/certification body not only in terms of organization and management, but also in terms of their activities;

they provide the client with technically valid (reliable, traceable) results);

operate in both unregulated and regulated areas (through regulatory mechanisms introduced by legislation that require testing, calibration, control and certification activities to be carried out by accredited conformity assessment bodies (for example, in the field of ecology, food safety, fuels and many others);

in cases of complaints and/or non-conformities, the laboratory/body can "rewind the tape", i.e. to trace the entire course of the processes in reverse order and establish the cause of the occurrence;

For the clients (users of services) of accredited laboratories:

the movement of goods and services in the European Economic Area is facilitated, which favors business development;

trust in the results of testing/calibration/control/certification is ensured with reference to accreditation - the results of the activity (protocols, certificates) are recognized without the need for the product to be tested/calibrated/controlled/certified again, both in the country and abroad (in countries that have signed the EA MLA for the relevant area);

Note: Accreditation is granted by a National Accreditation Body (in accordance with REGULATION (EC) No. 765/2008 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No. 339/93). The National Authority for Bulgaria is the Bulgarian Accreditation Agency (BAA), which is a party to the EA (MLA) for all areas.

STAGES IN PREPARATION FOR ACCREDITATION:

STAGE 1 Review of the status:

review of the status to establish compliance with the requirements of the applicable standard (BDS EN ISO/IEC 17020; BDS EN ISO/IEC 17025; BDS EN ISO 17065 and BDS EN ISO 15189);

analysis of the status and determination of the structure of the Management System in accordance with the specifics of the activity;

development of a plan - schedule for the implementation of the development, preparation of accompanying documents.;

2 STAGE Development of documents from the Quality Management System:

development of documents from the Management System - manual, procedures, lists and quality forms, etc.;

acceptance of documents by a joint working team;

3 STAGE Implementation:

conducting theoretical training;

conducting implementation training;

carrying out checks on the level of system implementation;

making changes to the documents if necessary during audits;

4 STAGE Functioning:

conducting training of internal auditors;

carrying out internal audits;

5 STAGE

 Submission of an application and accompanying documents to the National Accreditation Body - for Bulgaria Executive Agency "Bulgarian Accreditation Service" (www.nab-bas.bg)
assistance in filling out and completing the application and the documents applicable to it;

6 STAGE Assessment by the BSA EA

assistance in eliminating identified gaps/inconsistencies by the BSA EA.