The project required organizing calls with the client’s IT team, understand their IT processes and then identify the risks in their processes. Upon identifying the risks, appropriate control objectives and control description were associated with those risks. The final step was to mention the evidences that should be looked for. Conducted client consultation for the clauses and controls present in the ISO 27001:2013 standard.