Build and prepare your Information Security Management System for certification against ISO/IEC 27001:2022 — with no surprises at the certification audit.
ISO 27001 certification requires a working ISMS with risk-based controls, documentation and evidence. Getting there from scratch is where most organisations need help.
We assess your starting point, build out the ISMS — risk methodology, Statement of Applicability, policies and Annex A controls — and run a mock audit so you walk into certification confident.
Boundaries, context and interested parties.
Methodology and Statement of Applicability.
Annex A controls and supporting documents.
Demonstrating controls operate.
Readiness validation before the audit.
The kinds of organisations that rely on this work.
ISO/IEC 27001 readiness closes the gap between your current state and the certification audit so Stage 1 and Stage 2 run smoothly; certification is increasingly required by clients, tenders and regulators.
A structured implementation that follows the ISO 27001 management-system clauses (4–10) and Annex A, organised around the Plan–Do–Check–Act cycle.
Clause 4 — understand the organisation, interested parties and their requirements, and define the ISMS boundaries and scope.
Clause 5 — secure leadership commitment, establish the information security policy, and assign roles, responsibilities and authorities.
Clause 6 — define a repeatable risk-assessment and risk-acceptance methodology and set your information security objectives.
Identify, analyse and evaluate information security risks, then select treatment options and build the Risk Treatment Plan.
Justify the inclusion or exclusion of each Annex A control and document the Statement of Applicability (SoA).
Implement the selected Annex A organisational, people, physical and technological controls.
Clause 7.5 — produce the policies, procedures and records the ISMS requires, under version control.
Clause 7 — build competence and run awareness so the ISMS is understood and followed across the workforce.
Clause 8 — operate the ISMS day to day, executing the risk treatment plan and operational controls.
Clause 9 — monitoring, measurement, the internal audit and the management review.
Clause 10 — manage nonconformities and corrective actions, and drive continual improvement.
A typical journey from kickoff to certificate and through the three-year cycle. Stage 1, Stage 2, surveillance and recertification audits are conducted by an accredited certification body — kept independent of our implementation support, which we prepare you for and guide you through.
Certificate issued, valid 3 years
Year 1 — ISMS remains effective
Year 2 — continued assurance
Year 3 — full reassessment
Timelines are indicative and depend on scope, organisation size and resourcing. We agree a realistic schedule for your environment during planning.
We anchor this engagement to the standards and regulations that govern you.
What to have in place before we begin.
Explore this offering in detail.
Learn more →Explore this offering in detail.
Learn more →Explore this offering in detail.
Learn more →Back to the full pillar.
View pillar →Share where you are and where you want to be, and we’ll scope it with you.
