We help you build an ISMS that works in practice and prepare for the certification audit, while certification itself remains the decision of an accredited certification body.
Executive overview
Design and implement an information security management system aligned with ISO/IEC 27001:2022 and prepare your organization for an accredited certification audit.
ISO/IEC 27001:2022 specifies the requirements for an information security management system: defining its scope, assessing and treating information security risks, selecting controls with reference to Annex A, documenting them in a Statement of Applicability, and operating a cycle of monitoring, internal audit, management review and continual improvement. Organizations pursue it to respond to customer requirements, structure their security practices or demonstrate assurance to partners.
We support you from gap analysis through ISMS design, documentation and internal readiness assessment, to preparation for the external audit. We are not a certification body and do not issue certificates. Certification is granted solely by an accredited certification body following its own audit, and no advisory firm can guarantee the result; our role is to help you reach that audit with a management system that is operating and evidenced.
Business challenges addressed
- 01
An undefined or oversized scope
The ISMS scope is either too vague to audit or too broad to implement with available resources.
- 02
Documentation without a working system
Policies and templates are in place, but risk treatment, internal audit and management review are not actually operating.
- 03
Transition to the 2022 version
Organizations certified against the previous edition must realign their risk treatment and Statement of Applicability with the restructured Annex A controls.
- 04
Commercial pressure on timelines
Customer or tender requirements create pressure to move quickly, at the risk of building a system that will not sustain surveillance audits.
Services and solutions
- 01
ISO/IEC 27001 gap analysis
Assess current practices against the requirements of clauses 4 to 10 and the Annex A controls of ISO/IEC 27001:2022, and size the effort needed to close the gaps.
- 02
Information security management system design
Define the ISMS scope, context, interested parties, information security objectives, roles and the governance cycle that will operate the system.
- 03
Risk assessment methodology
Design a repeatable risk assessment and treatment method, run the first assessment with risk owners and produce the risk treatment plan.
- 04
Statement of Applicability support
Help you determine which Annex A controls apply, justify inclusions and exclusions, and record implementation status in a Statement of Applicability consistent with your risk treatment.
- 05
Security documentation
Produce the documented information the standard requires, and the policies and procedures your controls need, kept proportionate to the organization.
- 06
Internal readiness assessments
Perform an internal audit of the ISMS against the standard, test evidence of control operation and support the first management review.
- 07
Corrective action programs
Analyze nonconformities from internal or external audits, identify root causes and track corrective actions through to verified closure.
- 08
Certification preparation and support
Help you select an accredited certification body and prepare teams for the stage 1 and stage 2 audits. The certification decision rests solely with that body, following its own audit.
Typical engagement approach
- 01
Diagnose
Run the gap analysis, agree the ISMS scope and define a realistic readiness plan.
- 02
Build
Design the ISMS, assess risks, select Annex A controls and produce the Statement of Applicability and documentation.
- 03
Operate
Run controls, collect evidence, perform the internal audit and hold the management review.
- 04
Prepare
Close nonconformities, brief teams and support you through the certification body’s audit and its findings.
Expected deliverables
- ISO/IEC 27001:2022 gap analysis and readiness plan
- ISMS scope, context analysis and governance framework
- Risk assessment methodology, risk register and risk treatment plan
- Statement of Applicability
- ISMS documentation set: policies, procedures and records
- Internal audit report, management review minutes and corrective action plan
Outcomes you can target
- 01
An ISMS that operates in practice, not only on paper
- 02
A clear, defensible scope and Statement of Applicability
- 03
Teams prepared to explain and evidence their controls to auditors
- 04
A management system able to sustain surveillance and recertification audits
Related expertise
More in Cybersecurity & IT Audit
- Cybersecurity GovernanceDefine how security risk is owned, decided and reported, with a strategy, policy set and control framework proportionate to your organization.
- IT Audit & AssuranceIndependent reviews of IT general controls, access, change management and resilience, providing management and audit committees with reliable assurance.
- Security Improvement ProgramsTurn assessment findings into a prioritized, funded and governed program covering architecture, third parties, resilience and the management system.
Frequently asked questions
Do you certify organizations against ISO/IEC 27001?
No. We are an advisory firm, not a certification body, and we do not issue certificates. Certification is granted by an accredited certification body following its own independent audit. We prepare you for that audit, but we cannot and do not guarantee its outcome.
How long does ISO/IEC 27001 readiness take?
It depends on your scope, existing practices and available resources. The certification body will also expect the ISMS to have operated for a period, including an internal audit and management review, before the stage 2 audit. We set out a realistic plan after the gap analysis.
Can you also perform our internal ISMS audit?
Yes, provided independence is preserved: the people auditing the ISMS should not audit work they designed themselves. We organize our teams accordingly or can support your own internal auditors.
Talk to an expert about ISO/IEC 27001 Readiness
Tell us where you are today and what you need to achieve. We will propose the right scope for a first engagement.