Is it in the document?
- Policy available
- Procedure defined
- Check marked
- Evidence added to file
IT AUDIT • CYBER SECURITY • ISO 27001 PREPARATIONNot a Checklist.
Not a Checklist.
Real Technical Audit.
You can organize your IT environment, controls and ISO 27001 preparation not only through documents; We evaluate it based on technical evidence, configurations and actual control operation.
- 100+Audit experience
- 8 countriesInternational experience
- CISA • CISMProfessional perspective
A checklist doesn't tell you whether you are truly safe or not.
Defining policies, procedures and controls is a start. The question is whether they work consistently and sustainably in the technology environment.
ETC
Does it actually work?
- Are the powers really correct?
- Can it technically be bypassed?
- Are the logs sufficient and traceable?
- Does the cloud configuration match the policy?
- Does the control work constantly?
From introduction to permanent security.
We define the need accurately, evaluate it at the technical and governance level, and turn the findings into action.
Let's meet
Let us determine your IT audit, ISO 27001 preparation, control assessment or continuous control needs and authorized scope together.
Let's check
Let's examine IAM, Active Directory, cloud, network security, logging, vulnerability, backup, data, endpoint, third party, change and continuity areas according to need.
Let's report
Let's associate each finding with risk, technical evidence, impact, root cause, priority, action owner and target date. Let's present the executive summary and technical details together.
Stay Compatible
Let's periodically re-evaluate non-closing findings, new authorizations, changing configurations, new cloud resources and control errors.
Audit is not a photo frame, It is a continuous process.
Assessment depth appropriate to your risk.
IT Audit
End-to-end assessment of technical and governance controls within authorized scope.
ISO/IEC 27001 Compliance Preparation
Current situation, gap assessment, ISMS control evaluation and preparation before certification.
Technical Cyber Security Assessment
Evaluation of configurations, security controls and technical risks.
GRC & Control
Assessing risk, control design, control effectiveness and governance maturity.
Continuous Control
Monitoring the control level and improvement actions with monthly or periodic tests.
Special Audit
An in-depth study of a specific technology, process or risk area.
Not the existence of control,
It matters whether it works or not.
Reviews are not attacks or unauthorized access activities; It is carried out within the scope determined and authorized by the parties.
Checklist
“Is there a password policy?”
Technical evaluation
Besides the policy, how do the authentication structure, privileged access, technical configurations and related evidence of control work?
Checklist
“Is there a sensitive data policy?”
Technical evaluation
Do the actual data flows, accesses, storage areas and applicable technical controls match the policy?
Checklist
“Is there a cloud security policy?”
Technical evaluation
Have cloud configuration, IAM, logging, openness and critical security controls been implemented correctly?
United States · Local legal frameworkCybersecurity is now a leadership responsibility.
Cybersecurity is now a leadership responsibility.
U.S. disclosure requirements put cyber risk on the board’s agenda.
Laws differ across jurisdictions. Organizations within scope must identify obligations, document risk, test controls and maintain evidence. The selected country determines the legal framework shown below.
SEC • Cybersecurity disclosures
In force · 2023-09-05Reporting companies must disclose material cyber incidents and describe cyber risk management and governance.
Business impact
Connect materiality assessment, escalation and investor disclosure with board oversight.
For domestic issuers, Form 8-K Item 1.05 generally runs four business days from determining materiality, not discovery. Foreign private issuers and permitted delays have distinct rules; compliance dates were phased.
Last verified:CIRCIA • Reporting rulemaking
Draft / rulemaking in progressThe statute directs CISA to establish reporting requirements for covered critical infrastructure entities.
Business impact
Prepare incident identification and reporting workflows; monitor the final rule and its effective date.
The final rule was under regulatory review from 1 October 2026 at verification. Proposed reporting duties must not be presented as an operative blanket obligation.
Last verified:NIST CSF 2.0
Standards and guidance Published guidance · 2024-02-26A risk management framework organized around Govern, Identify, Protect, Detect, Respond and Recover.
Business impact
Use profiles and outcomes to prioritize improvements and communicate risk.
A framework, not a generally applicable national law. Adoption can be voluntary or required by a separate policy, contract or sector rule.
Last verified:General information. Assess scope, sector, thresholds and transitional provisions for each organization. The official text controls.
Country selection changes the legal information shown; it does not change governing contract law or the provider’s privacy documents.
Explore the legal framework →
KNOW THE PERSON PERFORMING THE INSPECTIONVolkan Guler
Volkan Guler
CISA, CISM
Enough business perspective to explain to the board of directors. A technical perspective that can go down to the system level.
After his education at Bilkent University and Sabancı University, he conducted academic studies with Bart Preneel at KU Leuven. He worked on the IT audit processes of two large banks in Turkey; He gained technology audit, risk and second-level control experience in Europe, the USA and Asia.
He worked in the control environment of banking, finance, technology, defense industry and more than 100 SMEs. He has transformed his experience into an approach that can read ISO 27001, IAM, data security, third-party risk and technology controls together.
CISACISMISO 27001IT AuditIAMData SecurityTechnology Risk
Just because your institution is small, your risk is not small.
SMEsSaaS companiestechnology companiesfinteche-commerceBusinesses that process dataInstitutions preparing for ISO 27001Those preparing for an investment or customer auditInstitutionalized startups
Start according to need,
Proceed according to maturity.
GRC Ustası Assessment
- Scoping
- Technical + GRC evaluation
- findings report
- Executive Summary
- Improvement roadmap
ISO 27001 Readiness
- Gap assessment
- ISMS readiness assessment
- Technical checks
- Deficiency analysis
- Preparation before certification
Continuous Assurance
- Regular control tests
- Finding and risk change tracking
- Technical control reviews
- Management reporting
- Continuous improvement
GRC Ustası PARTNER PROGRAM01 02
Let's build trust together.
Are there SMEs, technology companies or other businesses in your area that we can work with? We are open to customer development and professional project collaborations.
Sales Partnership
For the customers you bring that turn into contracts, they are subject to a sales contract, depending on the structure of the agreement. up to 50% commission opportunity.
Professional Collaboration
Opportunity to work together on projects if you have GRC, IT Audit, control, ISO 27001 or cyber security experience.
CORPORATE INTERVIEW
Let's see the real risks of your company together.
Share your need and scope. Let's clarify the goal, authorization boundaries and appropriate evaluation model in the first meeting.
volkan@grcustasi.com