ISO 27001 readiness support
An information security system that works, and stands up to the audit.
ISO/IEC 27001:2022 readiness: risk assessment, controls, policies and an internal audit before certification.
Why teams call us
Problems this solves
-
01
A tender requires ISO 27001
Government, enterprise and international buyers often list certification as a requirement.
-
02
The 2013 version is being retired
Certificates against ISO/IEC 27001:2013 must transition to the 2022 version.
-
03
Policies nobody follows
Documents written for an audit and then forgotten.
-
04
No clear view of information risk
Without a risk assessment, security spending is guesswork.
Our approach
ISO/IEC 27001 specifies requirements for an information security management system (ISMS): how you assess information risk, choose controls, run them and keep improving. The 2022 version groups its reference controls in Annex A into 93 controls across four themes: organisational, people, physical and technological.
Certification is granted by an accredited certification body, not by us. We help you build an ISMS that fits the size of your organisation, run a proper risk assessment, implement the controls you need, and carry out an internal audit and management review so you go into certification ready.
What is included
-
Scope and context
ISMS scope, interested parties and requirements defined.
-
Risk assessment
Information risks identified, rated and treated.
-
Statement of Applicability
Annex A controls selected and justified.
-
Policies and procedures
Documents your team can actually follow.
-
Control implementation
Technical and organisational controls put in place.
-
Internal audit
An independent internal audit and management review before certification.
What you receive
- ISMS scope document
- Risk assessment and treatment plan
- Statement of Applicability
- Policy and procedure set
- Internal audit report
- Certification readiness review
Technology we work with
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- Annex A
- Risk register
- Microsoft 365
- Google Workspace
Industries
How an engagement runs
Every engagement starts with a signed agreement and an advance payment as set out in your proposal. Work begins once both are complete.
-
01
Gap assessment
Current practices compared with the standard.
-
02
Build the ISMS
Scope, risk assessment, SoA, policies and controls.
-
03
Operate
Controls run and evidence recorded for a period before the audit.
-
04
Internal audit
Internal audit and management review, then support during certification.
Ready to start? Talk to us directly.
Tell us what you need in a few lines. A specialist replies with next steps and a written proposal before any work begins.
Frequently asked questions
Can't find your answer? Ask us
Do you certify us?
We are certified to the 2013 version. What now?
Is ISO 27001 enough for DPDP compliance?
Start with a conversation.
Share a few details. A specialist replies with next steps, usually starting with a short call.