- Home
- ISO 27001 consulting
ISO/IEC 27001:2022
ISO 27001 consulting and certification readiness
ISO 27001 is the international standard for an information security management system (ISMS). It's what enterprise buyers, regulators and government tenders increasingly ask for. We take you from first assessment to a passed certification audit.
- Standard
- ISO/IEC 27001:2022
- Structure
- Clauses 4–10 and Annex A (93 controls)
- Certification
- Stage 1 and Stage 2 audit by an accredited body
- Certificate cycle
- 3 years, with annual surveillance audits
What's included
Everything you need to get certified
Each engagement is scoped to your organisation. A full implementation typically covers:
- Scope and contextDefining the ISMS boundary, interested parties and their requirements.
- Gap assessmentClause-by-clause and Annex A review with a prioritised plan.
- Risk assessment and treatmentA practical methodology, risk register and treatment plan.
- Statement of ApplicabilityEvery Annex A control assessed, justified and mapped to evidence.
- Policies and proceduresWritten to fit your size and how your teams already work.
- Awareness trainingShort sessions so staff understand their part, which auditors will test.
- Internal auditA full independent internal audit, as clause 9.2 requires.
- Management reviewPreparing and facilitating the review with your leadership.
- Certification audit supportChoosing a certification body, then Stage 1 and Stage 2 preparation.
- Closing findingsCorrective action plans for any nonconformities raised.
- 37Organisational controls
- 8People controls
- 14Physical controls
- 34Technological controls
Who it's for
When ISO 27001 makes sense
You sell to enterprise or government
Security questionnaires and tender requirements get much shorter when you can show a current certificate.
You're a SaaS or technology provider
Customers handing you their data want independent assurance that it's protected.
You're regulated or about to be
ISO 27001 gives you a recognised framework that maps well to information security requirements in the GCC, Australia and the US.
You want security to be manageable
An ISMS turns security from a list of worries into a system with owners, priorities and regular review.
FAQ
ISO 27001 questions
How long does ISO 27001 certification take?
Most small and mid-sized organisations are ready for the certification audit within three to six months. Larger scopes, multiple sites or a low starting point take longer. The audit runs in two stages: Stage 1 reviews your documentation and readiness, Stage 2 tests whether the system works in practice.
What does ISO 27001 consulting cost?
It depends on scope, headcount, number of locations and how much already exists. After a short discovery call we give you a fixed-fee proposal, so you know the cost before work starts. Certification body fees are separate and paid directly to them.
Do we need to buy a compliance tool?
No. A tool can help with evidence collection, but it isn't required for certification. We can work in the tools you already use, or help you choose one if it makes sense for your size.
Do we have to implement all 93 Annex A controls?
No. You assess each control against your risks and record whether it applies, and why, in the Statement of Applicability. Excluding a control needs a justification the auditor will accept.
What happens after certification?
Certificates run on a three-year cycle with surveillance audits in years two and three. You'll need to keep running internal audits, management reviews and risk assessments. Ongoing support is available as part of our vCISO service.
Find out how far you are from certification.
Tell us where you are today. We'll come back with a clear view of the gaps, the effort involved and a realistic timeline. No obligation.