What it involves
Gap analysis against the standard, definition of the scope, risk assessment, drafting of the policies and procedures that will genuinely be followed, implementation of the technical controls and support through the certification audit. Afterwards, the upkeep: surveillance audits are annual and the system has to be kept alive, not filed away in a drawer.
