ISO 27001 readinesswith controls that survive operations.
Scope, risk assessment, Statement of Applicability, policies and the Annex A controls implemented in your real environment — then internal audit, management review and support through certification.
What we do
ISO 27001 is a risk-based system, not a checklist. We start with your assets and threats, choose controls that fit your environment, implement them with your IT and HR teams, and collect evidence as part of normal operations — so the ISMS survives after the consultants leave.
Our team runs security operations, hardening and access control for production infrastructure; the controls we recommend are ones we operate ourselves.
- Gap & risk assessmentContext, asset inventory, risk register, treatment plan
- ISMS documentationPolicies, SoA, procedures sized to your organisation
- Controls implementationAccess, logging, backup, vendor, HR and physical controls with IT
- Internal audit & management reviewFindings closed before certification
- Certification supportStage 1 and stage 2 attendance, surveillance support
The engagement, step by step
Scope
Assets, processes, locations and the clauses of the standard in scope.
Gap assessment
Every control reviewed against evidence; findings rated by risk.
Remediate
Owners, fixes and dates; policies and records built in your tools.
Certify
Mock audit, then support during the accredited body’s audit.
What we put in writing
Written into the blueprint before work starts. If a number is not here, ask for it — we put it in writing.
| Timeline | 3–6 months to readiness, typical |
|---|---|
| Deliverables | Risk register, SoA, policy set, internal audit report |
| Pricing | Fixed fee by scope and headcount |
| Standard | ISO/IEC 27001:2022 |
Questions we get asked
Does this cover cloud and SaaS?
Do you run penetration tests?
How much of our staff time is needed?
Tell us the standard or the vendor. We scope it as a fixed fee.
Scope and quote within two working days.