Compliance
ISO 27001 support
From the first assessment to the audit, with the people who actually run the systems.
We guide companies along the path to ISO/IEC 27001:2022 certification and keep it alive over the years. Our advantage is that we work on the infrastructure every day: the policies we write describe how the systems really work, and our products produce the evidence auditors ask to see.
The path
Four phases, adapted to where the company stands: some start from scratch, others just need to face the next audit.
Analysis and assessment
We define the scope, list assets and suppliers, analyse risks and compare the situation with the Annex A controls. A vulnerability assessment, and a penetration test where needed, on exposed networks, servers and websites shows where to begin.
Documentation
We write the policies and procedures of the management system: access control, backup and disaster recovery, incident management, acceptable use, suppliers, continuity. Every document has a technical version for IT and a version for the audit.
Technical measures
We close the vulnerabilities found, harden servers and remote access, segment the network and put tamper-evident logs, verified backups and monitoring in place, with our own tools or those the company already has.
Audit and upkeep
We prepare for audits, answer the auditors' technical questions and update the documentation whenever the systems change, so the management system stays alive between audits.
Evidence, ready for the auditor
Many Annex A controls ask you to prove that something actually happens: that access is logged, that backups work, that vulnerabilities are managed. Our products produce that evidence every day.
| Control | What it asks | How we cover it |
|---|---|---|
| 5.9 | Inventory of information and other associated assets | BitMapper Pro keeps an up-to-date inventory of workstations, servers and Active Directory accounts. |
| 5.15 · 8.2 | Access control and privileged access rights | BitMapper Pro logs system administrator access; DomainLoginTracker logs workstation logons. |
| 8.5 | Secure authentication | RDP Security Manager opens remote desktop only to authorised addresses or those enabled with signed tokens. |
| 8.8 | Management of technical vulnerabilities | Periodic vulnerability assessments and BitAudit, which checks Linux servers and websites read-only. |
| 8.13 | Information backup | BitBackup and documented backup policies, with isolated and off-site copies and results shown on the dashboard. |
| 8.15 | Logging | BitMapper Pro keeps file-access logs in a chain of cryptographic fingerprints with a daily timestamp: any change becomes evident. |
| 8.16 | Monitoring activities | BitDash watches network, servers, backups and building systems and flags issues at once. |
| 8.20 | Networks security | pfSense firewalls, VPN with individual certificates and network segmentation, designed and run by us. |
Numbers refer to the Annex A controls of ISO/IEC 27001:2022. The tools contribute to the controls listed; compliance depends on the company's whole management system.
Why us
We support companies with technical skills, not with forms to fill in.
The people who write the policies run the systems
Procedures come from how the infrastructure really works, and are updated when it changes.
Documents in two versions
A technical version with the details needed by whoever steps in, and one for the audit, clear and verifiable.
Tamper-evident evidence
Logs with a hash chain and timestamp, with integrity proofs emailed every day, also to an external address chosen by the company.
GDPR too
Technical measures, records and the data processor appointment when we run systems on the company's behalf.
We are not a certification body: we prepare and guide the company, and certification is issued by an accredited body.
Have an IT problem to solve or software to build?
Tell us what you need: we reply with a first assessment and, if useful, a product demo.
- info@bitbuster.biz
- Office
- Via delle Rondini 162, 00169 Rome, Italy
- VAT number
- IT06757891004
- PEC
- bitbustersrl@pec.it