We are a trusted cloud-based solution for all your governance, risk and compliance (GRC) needs, providing integrated modules for ISO27001 (and more) for risk management (and SoA), security incidents, GDPR requirements, supplier assessments etc.

Welcome to InfoSaaS

We are a trusted cloud-based solution for all your governance, risk and compliance (GRC) needs. Our service provides your personnel with simple, effective and compliant workflows to keep your business, your data and your customers secure, and supports the achievement and retention of external assessments such as ISO9001 and ISO27001 certification. As information security, data protection and technology specialists ourselves, InfoSaaS was originally developed to address our own need, and now supports customers across the world.

Core Functionality

• Management dashboard and reporting options
• Whole organisation personnel database ª allowing management of:
o Individual training records – mandatory and optional – supported by certificates and evidence
o Owners, reviewers and approves of formal documentation (policies, procedures etc)
o Individual asset tracking – logging which employee has which laptop, tokens, licences etc
o Participating in training events, internal audits, complaints, security incidents and much more
• Internal audit functionality ª enabling the production of audit reports with linkage to many assessed component elements, issuing and tracking of non-conformances, and production of audit statistics
• Complaint Tracker ª - record, investigate and respond to customer and third-party complaints
• Real-time calendar - maintain awareness of upcoming activities and current issues
• Objectives Tracker ª - recording, measuring progress and reporting your management system objectives
• Management Review Agenda ª - automatic production of the inputs for formal management reviews

Information Security Management (ISO27001) Functionality

• Comprehensive information security management dashboard and real-time risk register
• Organisational parameters, risk thresholds, security control sets selection
• Provided by default with controls aligned to ISO27001 Annex A, ISO27017 (cloud services), ISO27018 (personal data in the cloud), ISO27701 (privacy management) and ISO28000 (supply chain security)
• Create information assets, different types of supporting asset, and map the dependencies between them
• Using pre-prepared asset risk templates, highlighting many vulnerabilities or threats (or create your own)
• Risk assessments which integrate with various risk treatment options
• Real-time update of the Statement of Applicability (with time-stamped downloads)
• Security incident management, linking to personnel, assets, suppliers and much more
• Recording of personnel information security training and awareness within our Training Records module ª
• Links to calendar, internal audit, objectives and management review modules ª
• Supported by information security policies, procedures and templates from our Document Packs
• HIPAA compliance assessments ª

Data Production (GDPR) Functionality

• Intuitive workflow which allows the production of Data Protection Impact Assessments (GDPR Art.35)
• Module for the logging, progression and responding to data subject rights requests
• Integrated module for the logging, reporting and investigation of personal data breaches
• Recording of personnel data protection training and awareness within our Training Records module ª
• Assessment of supplier GDPR capabilities can be performed within our Supplier Management module
• Links to calendar, internal audit, objectives and management review modules
• Supported by data protection policies, procedures and templates from our Document Packs.

Supplier Management Functionality

• Use our default selection of commonly used supplier question sets (or create your own)
• Customise by organising questions into categories and categories into sections to meet your needs
• Pre-define how responses are to be scored, giving you a prompt numeric value for all responses
• Automated assessments are sent out electronically, completed on a secure website, and progress tracked
• Saves significant time, effort and resources over traditional paper and envelope requirements
• Links to calendar, internal audit, objectives and management review modules ª

Quality Management (ISO9001) Functionality

Many of the requirements of the ISO9001 standard can be identified above, these include:
• Management responsibility
• Management of quality objectives (within the Objectives Tracker)
• Document and records management
• Personnel roles and responsibilities (job descriptions within the Documentation module)
• Personnel training, awareness and competency (within the Training Records module)
• Alignment to activities of applicable legislation (e.g. using the Data Protection module)
• Complaint management (within the Complaints Tracker)
• Supplier management activities (within the Supplier Management module)
• Internal audit and non-conformance management
• Management review preparation (from the Management Review Agenda)

Other Information

• Secure cloud-based solution, subject to regular ITSHC CHECK technical security tests
• Available to UK public sector organisations through the Digital Marketplace
• Fast deployment for new customers (within minutes), efficient Support Analysts
• Hosted in secure UK data centre campuses by default
• Registered with the UK ICO for the Data Protection Act 2018 (EU GDPR 2016/679)
• Options for in-country hosting in most non-UK countries at no additional cost
• Opportunities for collaboration in the development of non-English language versions
• An active user community, who come together to propose new features and reports
• On-line certification for “InfoSaaS Certified Specialist” validating user competency ª

ª Note: indicates modules and functionality under production and beta testing for release in Q3 2020

Partnerships

InfoSaaS services are used by a large number of management system implementers and certification specialists, allowing them to provide a comprehensive overview of their customer’s activity and progress remotely. We are always interested in adding credible and trusted partners to our network. Please get in touch.