Is it in the document?
- Policy available
- Procedure defined
- Check marked
- Evidence added to file
IT AUDIT • CYBER SECURITY • ISO 27001 PREPARATIONNot a Checklist.
Not a Checklist.
Real Technical Audit.
You can organize your IT environment, controls and ISO 27001 preparation not only through documents; We evaluate it based on technical evidence, configurations and actual control operation.
- 100+Audit experience
- 8 countriesInternational experience
- CISA • CISMProfessional perspective
A checklist doesn't tell you whether you are truly safe or not.
Defining policies, procedures and controls is a start. The question is whether they work consistently and sustainably in the technology environment.
ETC
Does it actually work?
- Are the powers really correct?
- Can it technically be bypassed?
- Are the logs sufficient and traceable?
- Does the cloud configuration match the policy?
- Does the control work constantly?
From introduction to permanent security.
We define the need accurately, evaluate it at the technical and governance level, and turn the findings into action.
Let's meet
Let us determine your IT audit, ISO 27001 preparation, control assessment or continuous control needs and authorized scope together.
Let's check
Let's examine IAM, Active Directory, cloud, network security, logging, vulnerability, backup, data, endpoint, third party, change and continuity areas according to need.
Let's report
Let's associate each finding with risk, technical evidence, impact, root cause, priority, action owner and target date. Let's present the executive summary and technical details together.
Stay Compatible
Let's periodically re-evaluate non-closing findings, new authorizations, changing configurations, new cloud resources and control errors.
Audit is not a photo frame, It is a continuous process.
Assessment depth appropriate to your risk.
IT Audit
End-to-end assessment of technical and governance controls within authorized scope.
ISO/IEC 27001 Compliance Preparation
Current situation, gap assessment, ISMS control evaluation and preparation before certification.
Technical Cyber Security Assessment
Evaluation of configurations, security controls and technical risks.
GRC & Control
Assessing risk, control design, control effectiveness and governance maturity.
Continuous Control
Monitoring the control level and improvement actions with monthly or periodic tests.
Special Audit
An in-depth study of a specific technology, process or risk area.
Not the existence of control,
It matters whether it works or not.
Reviews are not attacks or unauthorized access activities; It is carried out within the scope determined and authorized by the parties.
Checklist
“Is there a password policy?”
Technical evaluation
Besides the policy, how do the authentication structure, privileged access, technical configurations and related evidence of control work?
Checklist
“Is there a sensitive data policy?”
Technical evaluation
Do the actual data flows, accesses, storage areas and applicable technical controls match the policy?
Checklist
“Is there a cloud security policy?”
Technical evaluation
Have cloud configuration, IAM, logging, openness and critical security controls been implemented correctly?
United Kingdom · Local legal frameworkCybersecurity is now a leadership responsibility.
Cybersecurity is now a leadership responsibility.
UK rules connect data protection, service security and accountability.
Laws differ across jurisdictions. Organizations within scope must identify obligations, document risk, test controls and maintain evidence. The selected country determines the legal framework shown below.
NIS Regulations 2018
In force · 2018-05-10Security and incident reporting duties apply to covered essential services and relevant digital service providers.
Business impact
Determine the correct sector regulator and maintain proportionate security and incident reporting arrangements.
Coverage and notification criteria depend on service and designation. The EU NIS2 Directive does not automatically apply as UK domestic law.
Last verified:UK GDPR • DPA 2018
In force · 2018-05-25The UK data protection framework governs personal data processing, security and individual rights.
Business impact
Maintain lawful bases, accountability records, rights handling and breach assessment.
The Data (Use and Access) Act 2025 amends rather than replaces UK GDPR and DPA 2018. Most Part 5 data protection changes commenced on 5 February 2026; commencement remains provision-specific.
Last verified:General information. Assess scope, sector, thresholds and transitional provisions for each organization. The official text controls.
Country selection changes the legal information shown; it does not change governing contract law or the provider’s privacy documents.
Explore the legal framework →
KNOW THE PERSON PERFORMING THE INSPECTIONVolkan Guler
Volkan Guler
CISA, CISM
Enough business perspective to explain to the board of directors. A technical perspective that can go down to the system level.
After his education at Bilkent University and Sabancı University, he conducted academic studies with Bart Preneel at KU Leuven. He worked on the IT audit processes of two large banks in Turkey; He gained technology audit, risk and second-level control experience in Europe, the USA and Asia.
He worked in the control environment of banking, finance, technology, defense industry and more than 100 SMEs. He has transformed his experience into an approach that can read ISO 27001, IAM, data security, third-party risk and technology controls together.
CISACISMISO 27001IT AuditIAMData SecurityTechnology Risk
Just because your institution is small, your risk is not small.
SMEsSaaS companiestechnology companiesfinteche-commerceBusinesses that process dataInstitutions preparing for ISO 27001Those preparing for an investment or customer auditInstitutionalized startups
Start according to need,
Proceed according to maturity.
GRC Ustası Assessment
- Scoping
- Technical + GRC evaluation
- findings report
- Executive Summary
- Improvement roadmap
ISO 27001 Readiness
- Gap assessment
- ISMS readiness assessment
- Technical checks
- Deficiency analysis
- Preparation before certification
Continuous Assurance
- Regular control tests
- Finding and risk change tracking
- Technical control reviews
- Management reporting
- Continuous improvement
GRC Ustası PARTNER PROGRAM01 02
Let's build trust together.
Are there SMEs, technology companies or other businesses in your area that we can work with? We are open to customer development and professional project collaborations.
Sales Partnership
For the customers you bring that turn into contracts, they are subject to a sales contract, depending on the structure of the agreement. up to 50% commission opportunity.
Professional Collaboration
Opportunity to work together on projects if you have GRC, IT Audit, control, ISO 27001 or cyber security experience.
CORPORATE INTERVIEW
Let's see the real risks of your company together.
Share your need and scope. Let's clarify the goal, authorization boundaries and appropriate evaluation model in the first meeting.
volkan@grcustasi.com