Solution · ISO/IEC 27001:2022

The human factor of your ISMS, covered end to end

A program that meets the ISO 27001 awareness and competence requirements: your policy shared and acknowledged, trained reflexes, measured effectiveness and evidence ready for your audit.

Book a demoSee how it maps to the standard

Our answer

Four commitments, one platform

  • Make everyone aware of your policy

    Your security policy becomes a module in your colors, and every employee confirms they have read it.

  • Train the right reflexes

    Simulations on eight channels, reporting of suspicious messages, serious games and crisis exercises.

  • Measure effectiveness

    A risk score per person, team and entity, showing progress from one year to the next.

  • Document effortlessly

    Dated history, certificates and automated reports, exportable on audit day.

Mapping to the standard

What ISO 27001 requires, what BlueSecure provides

Requirements paraphrased from the 2022 version. Annex A controls apply according to your Statement of Applicability.

Directthe requirement is covered by the platformContributionBlueSecure feeds a control that remains yours

  • 7.3Everyone knows the security policy and their own contribution to the ISMSCustom module of your policy, ISO 27001 module, contractors included in scopeDirect
  • 7.2Competence suited to each role, evaluated effectiveness, retained evidenceRole-based paths, scores, dated history, certificatesDirect
  • 9.1Monitor and measure the effectiveness of the ISMSTracking, risk and reporting indicators, automated reportsDirect
  • A.5.1Policies communicated to and acknowledged by staffNamed, time-stamped "I have read and understood", exportableDirect
  • A.6.3Awareness, education and training, updated regularly100+ modules, new content every month, 12 languages, serious gamesDirect
  • A.6.8Reporting of information security eventsOne-click reporting of suspicious messages, rate measured in simulationsDirect
  • A.5.24 to A.5.29Incident management: preparation, response, lessons learnedBlackOut™ for everyone, BlackOut™ crisis workshop for the executive committeeDirectfor exercising the crisis unit
  • A.5.30ICT readiness for business continuity (BCP, DRP)Exercise of the crisis unit and of continuity and recovery decisionsContribution
  • A.8.28, A.8.8Secure coding and management of technical vulnerabilitiesRedCode™, a 15-minute escape game for developersContribution
  • A.5.10 and othersUse of assets, access, passwords, remote work, removable mediaTargeted modules from the Learning Academy™ catalog and Phishing 360™ simulationsContribution

The program

Five streams, assembled for your ISMS

  1. Stream 1

    ISO 27001 path

    The ISO 27001 module first, then a foundation aligned with Annex A. RedCode™ for your developers.

    Learning Academy™, CyberGames™
  2. Stream 2

    Your security policy

    Your policy turned into a module, with tracked acknowledgement.

    Learning Studio
  3. Stream 3

    Simulations and reporting

    Multi-channel simulations, vigilance banner and analysis of reported messages.

    Phishing 360™, MailWatch™
  4. Stream 4

    Incidents and crisis

    BlackOut™ online for everyone, an in-room crisis workshop for the executive committee.

    CyberGames™, Workshop™
  5. Stream 5

    Evidence and steering

    Risk score, automated reports and exports for your audit.

    Risk Index™, Smart Report™

How it runs

Aligned with your audit calendar

  1. Month 1

    Baseline

    A first simulation campaign measures the starting point.

  2. Months 1 to 3

    Standard and policy

    ISO 27001 module and your policy module, with tracked acknowledgement.

  3. Months 3 to 9

    Foundation and reflexes

    Role-based modules, campaigns adapted to the risk score.

  4. Months 9 to 10

    Crisis exercise

    BlackOut™ for everyone, a crisis workshop for the executive committee.

  5. Before the audit

    Evidence file

    Reports, history and indicators exported in one click.

Our scope

What stays in your hands

BlueSecure covers the human factor. The rest of the ISMS is up to your teams or your consultants.

  • Designing the ISMS and the risk assessment
  • The Statement of Applicability and the internal audit
  • Certification support
  • Technical controls and recovery testing of your systems

They build their reflexes with BlueSecure

organizations supported
500+

organizations supported

employees trained
700,000+

employees trained

user satisfaction
4.8/5

user satisfaction

hosted in France by ISO 27001 certified European providers
EU

hosted in France by ISO 27001 certified European providers

Your questions about the program

Is BlueSecure ISO 27001 certified?
The ISO 27001 certification applies to the platform's hosting providers. Platform data is hosted in France by French hosting providers certified ISO 27001, which are not subject to extraterritorial laws such as the US CLOUD Act. Details of our security measures are available on request.
Does the program guarantee our certification?
No. Certification depends on your whole ISMS. The program covers the human factor and gives you the matching evidence.
Can we deploy our own security policy?
Yes. Your policy becomes a module in your colors, and every employee confirms they have read it. The confirmation is named, time-stamped and exportable.
Does the crisis workshop replace our continuity tests?
No. The BlackOut™ crisis workshop exercises your crisis unit on a scenario built from your own setup. It fits into your continuity exercise program without replacing it.
Can our contractors follow the program?
Yes. People working under your control, contractors included, can be brought into scope and tracked like your employees.
ISO 27001

Prepare the human side of your ISMS

We start from your policy and your audit calendar.

Book a demoSee also NIS2

it's not boring anymore.