Is it in the document?
- Policy available
- Procedure defined
- Check marked
- Evidence added to file
IT AUDIT • CYBER SECURITY • ISO 27001 PREPARATIONNot a Checklist.
Not a Checklist.
Real Technical Audit.
You can organize your IT environment, controls and ISO 27001 preparation not only through documents; We evaluate it based on technical evidence, configurations and actual control operation.
- 100+Audit experience
- 8 countriesInternational experience
- CISA • CISMProfessional perspective
A checklist doesn't tell you whether you are truly safe or not.
Defining policies, procedures and controls is a start. The question is whether they work consistently and sustainably in the technology environment.
ETC
Does it actually work?
- Are the powers really correct?
- Can it technically be bypassed?
- Are the logs sufficient and traceable?
- Does the cloud configuration match the policy?
- Does the control work constantly?
From introduction to permanent security.
We define the need accurately, evaluate it at the technical and governance level, and turn the findings into action.
Let's meet
Let us determine your IT audit, ISO 27001 preparation, control assessment or continuous control needs and authorized scope together.
Let's check
Let's examine IAM, Active Directory, cloud, network security, logging, vulnerability, backup, data, endpoint, third party, change and continuity areas according to need.
Let's report
Let's associate each finding with risk, technical evidence, impact, root cause, priority, action owner and target date. Let's present the executive summary and technical details together.
Stay Compatible
Let's periodically re-evaluate non-closing findings, new authorizations, changing configurations, new cloud resources and control errors.
Audit is not a photo frame, It is a continuous process.
Assessment depth appropriate to your risk.
IT Audit
End-to-end assessment of technical and governance controls within authorized scope.
ISO/IEC 27001 Compliance Preparation
Current situation, gap assessment, ISMS control evaluation and preparation before certification.
Technical Cyber Security Assessment
Evaluation of configurations, security controls and technical risks.
GRC & Control
Assessing risk, control design, control effectiveness and governance maturity.
Continuous Control
Monitoring the control level and improvement actions with monthly or periodic tests.
Special Audit
An in-depth study of a specific technology, process or risk area.
Not the existence of control,
It matters whether it works or not.
Reviews are not attacks or unauthorized access activities; It is carried out within the scope determined and authorized by the parties.
Checklist
“Is there a password policy?”
Technical evaluation
Besides the policy, how do the authentication structure, privileged access, technical configurations and related evidence of control work?
Checklist
“Is there a sensitive data policy?”
Technical evaluation
Do the actual data flows, accesses, storage areas and applicable technical controls match the policy?
Checklist
“Is there a cloud security policy?”
Technical evaluation
Have cloud configuration, IAM, logging, openness and critical security controls been implemented correctly?
European Union · Local legal frameworkCybersecurity is now a leadership responsibility.
Cybersecurity is now a leadership responsibility.
EU requirements depend on sector, role and national implementation.
Laws differ across jurisdictions. Organizations within scope must identify obligations, document risk, test controls and maintain evidence. The selected country determines the legal framework shown below.
EU AI Act
In force · 2024-08-01A risk-based framework with obligations varying by AI use, system category and operator role.
Business impact
Identify provider or deployer roles and the applicable implementation phase.
Entry into force is not the application date for every obligation. Phased dates and any enacted amendments must be checked for each provision; no single fine or deadline applies to all AI systems.
Last verified:DORA
In force · 2025-01-17DORA governs digital operational resilience for financial entities within its scope.
Business impact
Manage ICT risk, incidents, resilience testing and ICT third-party dependencies.
Application date shown. Entity exemptions, proportionality and technical standards matter; DORA is sector-specific in relation to overlapping NIS2 requirements.
Last verified:GDPR
In force · 2018-05-25Personal data processing is subject to lawfulness, accountability, security and data subject rights.
Business impact
Document processing, assess risks and manage processors and international transfers.
Territorial scope follows Article 3, not the visitor’s language. Breach notification depends on risk and the relevant controller or processor role.
Last verified:NIS2 Directive
In force · 2023-01-16The Directive sets cybersecurity risk management, governance and incident reporting requirements for covered sectors.
Business impact
Map services, size thresholds and national transposition before assigning obligations.
National transposition and competent authorities differ. The January 2026 targeted amendments are proposals, not automatically effective amendments.
Last verified:General information. Assess scope, sector, thresholds and transitional provisions for each organization. The official text controls.
Country selection changes the legal information shown; it does not change governing contract law or the provider’s privacy documents.
Explore the legal framework →
KNOW THE PERSON PERFORMING THE INSPECTIONVolkan Guler
Volkan Guler
CISA, CISM
Enough business perspective to explain to the board of directors. A technical perspective that can go down to the system level.
After his education at Bilkent University and Sabancı University, he conducted academic studies with Bart Preneel at KU Leuven. He worked on the IT audit processes of two large banks in Turkey; He gained technology audit, risk and second-level control experience in Europe, the USA and Asia.
He worked in the control environment of banking, finance, technology, defense industry and more than 100 SMEs. He has transformed his experience into an approach that can read ISO 27001, IAM, data security, third-party risk and technology controls together.
CISACISMISO 27001IT AuditIAMData SecurityTechnology Risk
Just because your institution is small, your risk is not small.
SMEsSaaS companiestechnology companiesfinteche-commerceBusinesses that process dataInstitutions preparing for ISO 27001Those preparing for an investment or customer auditInstitutionalized startups
Start according to need,
Proceed according to maturity.
GRC Ustası Assessment
- Scoping
- Technical + GRC evaluation
- findings report
- Executive Summary
- Improvement roadmap
ISO 27001 Readiness
- Gap assessment
- ISMS readiness assessment
- Technical checks
- Deficiency analysis
- Preparation before certification
Continuous Assurance
- Regular control tests
- Finding and risk change tracking
- Technical control reviews
- Management reporting
- Continuous improvement
GRC Ustası PARTNER PROGRAM01 02
Let's build trust together.
Are there SMEs, technology companies or other businesses in your area that we can work with? We are open to customer development and professional project collaborations.
Sales Partnership
For the customers you bring that turn into contracts, they are subject to a sales contract, depending on the structure of the agreement. up to 50% commission opportunity.
Professional Collaboration
Opportunity to work together on projects if you have GRC, IT Audit, control, ISO 27001 or cyber security experience.
CORPORATE INTERVIEW
Let's see the real risks of your company together.
Share your need and scope. Let's clarify the goal, authorization boundaries and appropriate evaluation model in the first meeting.
volkan@grcustasi.com