01
Gap assessment
We assess the current state against ISO 27001 expectations and identify the shortest defensible path forward.
- Scope and applicability review
- Current control maturity assessment
- Prioritized remediation map
ISO 27001 | NIST CSF | Governance | Audit Readiness
Practical ISO 27001 and NIST CSF implementation for organizations that need structure, evidence, and momentum.
We help teams translate ISO 27001 and the NIST Cybersecurity Framework from abstract requirements into operating systems with clear ownership, usable controls, and credible readiness for audit, assurance, and board-level reporting.
- ISMS and NIST CSF design aligned to organizational context and risk
- Control implementation support with evidence planning and maturity uplift
- Readiness for internal review, leadership oversight, certification, and framework-based assurance
Implementation
Readiness
- Define scope, critical services, risks, and control priorities.
- Build policies, procedures, ownership models, and framework-aligned operating cadence.
- Prepare evidence, internal review artifacts, and management reporting.
What we do
Implementation support that closes the gap between intent and operating reality.
The work is tailored to the maturity of the organization. Some teams need a full ISO 27001 implementation path; others need NIST CSF alignment, remediation, evidence hygiene, or a stronger internal operating rhythm.
02
ISMS design
We help build the management system itself, not just isolated documents.
- Policies and core procedures
- Roles, ownership, and governance forums
- Risk assessment and treatment structure
03
Control implementation
We support the controls, evidence, and operating practices needed to make the system work day to day.
- Control mapping to practical workflows
- Evidence register and artifact planning
- Operational guidance for teams
04
NIST CSF implementation
We help organizations align security programs to the NIST Cybersecurity Framework in a way that supports prioritization, maturity discussions, and executive visibility.
- Profile and maturity baseline development
- Identify, Protect, Detect, Respond, Recover mapping
- Target-state planning and remediation sequencing
Implementation phases
A clear sequence from assessment to readiness.
We use phased delivery so organizations can see progress, assign ownership, and avoid turning certification work into an uncontrolled documentation exercise.
01
Assess and scope
Confirm organizational scope, stakeholders, business context, high-risk assets, and certification goals.
02
Design the ISMS
Develop the policy set, governance structure, risk methodology, and the Statement of Applicability foundation.
03
Implement and collect evidence
Operationalize controls, assign control owners, build records, and clean up evidence trails.
04
Review and prepare
Support internal audits, management review preparation, corrective actions, and readiness for external assessment.
Typical deliverables
Outputs designed to be used, not just filed away.
Governance pack
Core management system artifacts
- ISMS policy framework and supporting procedures
- Risk assessment and treatment methodology
- Statement of Applicability structure
Operational pack
Control ownership and evidence readiness
- Control ownership matrix
- Evidence and records checklist
- Remediation tracker for identified gaps
Readiness pack
Audit and review support
- Internal audit preparation support
- Management review input structure
- Corrective action follow-through planning
Resources
Implementation support led by experienced audit, governance, and technical security practitioners.
This work is backed by practical security, audit, privacy, and governance experience across organizations operating in regulated, multi-country, and service-critical environments.
Lead implementer
Peter Tsamwa
Cyber Security Strategist | CISSP | CISA | CISM | CDPSE | ISO 27001 Senior Lead Implementer
A cybersecurity strategist with more than 14 years of experience across telecommunications and financial services environments. His delivery work covers security governance, business continuity, AI policy, technology risk management, data protection, privacy, cloud security, and operational control design from small business contexts through to enterprise-scale environments.
Core credentials
- MSc Cyber Security, University of London
- BSc Information Technology
- CISSP, CISA, CISM, and CDPSE
- ISO/IEC 27001 Senior Lead Implementer
- AWS Certified Cloud Practitioner
- Microsoft Azure security and AI certifications
Focus areas
- ISO 27001 implementation leadership
- Security governance and technology risk management
- Business continuity and operational resilience
- AI policy and responsible adoption
- Privacy, data protection, and control assurance
- Cloud security across AWS and Azure environments
Lead auditor
Gcinum'zi Chirunga
ISO 27001 Lead Auditor | IT Risk, Security, Privacy, and Audit
An IT risk, security, and audit professional with more than 10 years of experience supporting organizations across multiple countries. His delivery experience spans financial services, regulated enterprises, operational platforms, and service environments that need stronger governance, defensible controls, and audit-ready evidence.
Core credentials
- ISO 27001 Lead Auditor / Senior Lead Auditor
- Certified Information Systems Auditor (CISA)
- Certified Data Privacy Solutions Engineer (CDPSE)
- BSc Information Technology
- EQ Practitioner
- AI Governance and Security training
Focus areas
- ISMS implementation and audit readiness
- IT risk assessments and control design
- Security governance and policy frameworks
- Data privacy and control assurance
- Internal audit support and remediation planning
- AI governance, risk, and responsible adoption
Technical expert
Christopher Machango
CISSP | CISM | CISA | CEH | CCNP Security | CCNP R&S
A cybersecurity and infrastructure professional with over 12 years of experience across network security, systems administration, and operational security delivery. His work has supported enterprise networks, security-sensitive environments, and organizations that need stronger technical foundations for framework implementation, resilience, and control assurance.
Core credentials
- CISSP, CISM, CISA, and CEH
- CCNP Security and CCNP Routing & Switching
- Fortinet NSE4
- Linux+ and MCITP
- BSc Computer Science
- MBA in Information Technology Management
Focus areas
- NIST CSF implementation and control mapping
- Network and infrastructure security
- Linux and Windows systems administration
- API security and technical risk reduction
- Security operations and hardening
- Technical architecture support for governance programs
Best fit
Where this service is most useful.
Growing technology companies
Teams that need structure before customer due diligence or formal certification pressure increases.
Regulated organizations
Businesses that need stronger security governance, evidence, and internal control discipline.
Multi-team operations
Organizations where security depends on coordination across product, engineering, operations, and leadership.
Certification-bound teams
Groups preparing for external audits and trying to avoid late-stage documentation and evidence gaps.
Talk to us
Start with an ISO 27001 readiness conversation.
We can help determine scope, identify likely blockers, and define the implementation path that matches your organization's maturity.
Email: info@appmw.xyz
Phone: +265 980 070 441