Professional — Assess & Implement
The tier that moves an organisation from documents to demonstrable operation
Professional is where preparation becomes a programme. Gap assessment produces owned findings; findings feed risk treatment; treatment produces implementation; implementation produces evidence; internal audit verifies it; management review closes the loop. This is the tier most preparation teams actually need.
Who this is for
- Teams with a policy baseline who now need to close gaps systematically
- Organisations with an assessment date in the calendar
- Suppliers who must assess their own third parties and follow findings to closure
- Teams aligning an existing ISO/IEC 27001 management system with automotive expectations
Professional
Assess & Implement
Add the operating layer: risk, actions, evidence, suppliers and ISO/IEC 27001 alignment.
- Everything in Starter
- Gap analysis workbook with remediation action plan and readiness dashboard
- Information security risk register and treatment plan
- Supplier assessment questionnaire and third-party NDA template
- Management review template
- ISO/IEC 27001 alignment layer with Statement of Applicability
- Prototype protection and data protection covered within the assessment and SoA
Best for: Best fit for teams actively preparing for a TISAX assessment or customer information-security review.
One-time purchase — not a subscription. Your purchase includes the toolkit as it exists at the time of purchase. Future major editions are not automatically included.
The outcomes this tier is built for
A gap assessment that produces action
Findings with an owner, a priority, a target date and the evidence that would close them — not a colour-coded spreadsheet.
A risk register that leads to decisions
Documented method, owners, treatment plans, and residual risk formally accepted by someone with the authority to accept it.
Supplier assessment with follow-through
A third-party register with criticality tiering, an assessment set, and a follow-up log that shows closure rather than dispatch.
Management review that produces a record
Agenda, structured input pack and a decision record — the artefact a verbal update never generates.
ISO/IEC 27001 alignment
A mapping view and Statement of Applicability structure so one management system serves both purposes instead of two disagreeing with each other.
Scope extensions where they apply
Prototype protection and data protection readiness structures, used only if those scopes apply to you.
What is included
Core Policies
Information security policy set with ownership and review cadence.
ISMS Scope Document
Scope statement covering sites, entities, systems and information types.
Classification & Handling Guide
Classification levels with storage, transfer and destruction rules.
Awareness Training
Employee awareness deck with an acknowledgment sheet.
Readiness Self-Assessment
Detailed control-level self-assessment with baseline and advanced criteria per theme.
Gap Analysis Workbook
Chapter-level gap analysis with remediation action plan and calculated readiness dashboard.
Risk Management
Risk register, criteria, treatment plan and residual risk acceptance.
Supplier Assessment
Third-party security questionnaire and follow-up tracking.
Management Review Template
Agenda, structured inputs and decision record aligned to management system practice.
ISO/IEC 27001 Alignment Layer
Mapping view and Statement of Applicability structure.
Prototype Protection Readiness
Prototype protection controls covered within the self-assessment and the Statement of Applicability.
Data Protection Readiness
Data protection controls covered within the self-assessment and the Statement of Applicability.
What is not included
Stated plainly, because finding out after purchase is a bad experience.
- Multi-Site Governance
- CAPA Tracker
- KPI / KRI Dashboard
- Third-Party Portfolio
- Training Matrix
- Executive Reporting
- Consulting, document review, or attendance at your assessment
- Any guarantee of an assessment result, label or certification
Need what is missing above?
Enterprise adds it. Groups running several sites or legal entities, and teams that must report readiness upward on a fixed cycle.
Compare Enterprise →Questions about this tier
Do we need Starter as well?
We are one site. Is Enterprise overkill?
How long does it take to work through?
Does it cover prototype protection?
Not sure this is the right tier?
The free self-assessment ends with a recommendation based on your readiness indicator and organisation profile — including the reasoning, so you can disagree with it.