Created Information security policies based on compliance or risk. Created gap assessments following ISO27001 requirements