Skip to content
TJ Infinitium
Menu

Standards work best when they share one system.

TJ Infinitium advises on ISO/IEC 27001, ISO/IEC 27701, ISO 50001, ISO/IEC 42001 and IEC 62443, with data governance underneath. We get you ready for certification; an independent body certifies.

Book a scoping callSee the standards

Which standards are you weighing?

ISO/IEC 27001 is built on the clause structure below. Anything you add later reuses it.

Built once, shared by all four

  1. Clause 4Context. Who the system serves, what it covers, and which processes sit inside it.
  2. Clause 5Leadership. One policy framework, defined roles, and management that is visibly accountable.
  3. Clause 6Planning. One method for risks and opportunities, and objectives you can measure.
  4. Clause 7Support. Resources, competence, awareness and document control, set up once.
  5. Clause 8Operation. Planned, controlled day-to-day work. This is where the standards differ most.
  6. Clause 9Performance evaluation. Monitoring, one internal audit programme and one management review.
  7. Clause 10Improvement. One route for nonconformities, corrective action and continual improvement.

Added for your selection

ISO/IEC 27001

  • Information security risk assessment and treatment
  • A Statement of Applicability
  • The Annex A control set (93 controls in the 2022 edition)
Ask about this combination

What we do

Data governance, underneath all of it

Every standard we work with eventually asks the same question: what data do you have, who is responsible for it, and how do you know it is handled properly? Answering it once, in plain terms, saves you from answering it five times in five formats.

In Malaysia, the Personal Data Protection Act 2010 as amended in 2024 adds duties such as breach notification and, for some organisations, appointing a data protection officer. We build the records and processes those duties depend on. For legal interpretation, your lawyer remains the right voice.

What the data feeds

ISO/IEC 27001
The inventory becomes the basis for your asset list and risk assessment.
ISO/IEC 27701
Classification and ownership turn into your records of personal data processing.
ISO/IEC 42001
Lineage and quality rules govern the data your AI systems learn from and act on.

What we put in place

  • Know what you hold. A data inventory and a classification scheme people can actually apply, so every system and dataset has a stated sensitivity.

  • Name who is accountable. Owners and stewards for each important dataset, with decision rights written down instead of assumed.

  • Control its life. Rules for access, sharing, retention and disposal, matched to the systems where the data really lives.

  • Be able to show it. Records and evidence that stand up to a customer review, an internal audit or a certification audit.

From first look to a standing system

The same six steps apply whichever standards you choose. Certification itself is a separate, independent step, and we do not take part in the decision.

  1. 1

    Scope and gap assessment

    We agree what the system covers, then compare what you do today with what the standard requires. You receive a written gap list ranked by effort and risk.

  2. 2

    Design

    Policies, processes and roles are shaped around how your organisation already works, not copied from another company's template.

  3. 3

    Implement

    Your teams run the new processes while we coach them, review the evidence they produce, and fix whatever does not fit.

  4. 4

    Internal audit and management review

    Every one of these standards requires both. We run them with you or train your people to run them, so the first external audit is not your first audit.

  5. 5

    Certification audit

    You choose an accredited certification body. We prepare your people and evidence, and stay available while the audit runs.

  6. 6

    Keep it working

    Surveillance audits, changes in scope, and the improvements your own audits uncover.

Questions we hear first

Do you issue the certificate?
No. Certification is issued by an accredited certification body that is independent of us. We advise and prepare you; keeping that separation is what makes the certificate credible.
Do we need all four management system standards?
Almost never at the start. Most organisations begin with the one a customer or regulator is asking about, and add others later. Because they share one structure, the first system is reusable. The selector on the home page shows what carries over.
Can the standards be audited together?
Often, yes. Many certification bodies offer combined audits for management system standards, subject to their accreditation scope. Ask the bodies you are considering before you commit.
Is IEC 62443 only for factories?
No. It covers industrial automation and control systems wherever they run: plants, utilities, buildings, logistics sites and the suppliers who build the equipment for them.
Does this make us compliant with the law?
A management system standard is not a legal opinion. We help you build the processes and records that legal duties depend on, such as those under Malaysia's Personal Data Protection Act 2010 as amended in 2024. For interpretation of the law itself, work with your legal adviser.
How long will it take, and what will it cost?
It depends on scope, size, and how much you already have in place. A scoping call lets us give you a realistic range rather than a guess.

Not sure where to start?

A scoping call is a conversation about your organisation, the standards in play, and what a sensible first step looks like.

Book a scoping call