Usually a requirement with a deadline
ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It is recognised worldwide. It usually arrives as a requirement from a customer, a tender or an investor, with a hard date attached. We take ownership of the programme so your engineers stay on the product, and we prepare you for the audit as it will actually be conducted.
What we deliver
- Gap analysis, scope definition and ISMS design
- Risk assessment, risk treatment plan and Statement of Applicability (SoA)
- The full policy, procedure and control set, written for you rather than copied from a template
- Control implementation support alongside your own teams
- Internal audit and management review, run to the standard
- Stage 1 and Stage 2 audit readiness, attendance in the audit room and liaison with the certification body
- Annual surveillance and recertification cycle management
A structured journey to certification
- 01
Initial assessment & planning
- Discovery workshop: scope and boundaries, current state, resources and timeline
- Gap analysis: ISMS requirements, existing controls, compliance gaps
- Project roadmap: implementation timeline, resource plan, budget
- 02
Foundation building
- Leadership engagement: management commitment, roles and responsibilities, a security steering committee
- ISMS framework: information security policy, process documentation, control framework design
- Risk management: asset inventory, risk assessment methodology, treatment plan
- 03
Implementation & documentation
- Policy development: complete ISMS documentation, procedures, work instructions
- Control implementation: security measures, technical controls, operating procedures
- Training and awareness: staff awareness, key personnel training, process owner education
- 04
Testing & optimisation
- Internal audit: full ISMS evaluation, process effectiveness, non-conformities
- Management review: performance metrics, improvement opportunities, resource adequacy
- ISMS refinement: process optimisation, documentation updates, control effectiveness
- 05
Certification
- Stage 1 audit: documentation review support, readiness confirmation, initial findings
- Stage 2 audit: audit support, evidence, interview preparation
- Certificate: non-conformity resolution, corrective actions, certification confirmation
We think like the auditor, because we are one
Since 2018, our CEO has served as a senior ISO 27001 lead auditor for the Standards Institution of Israel. Our consultants hold credentials including ISO 27001 Lead Auditor, CISSP, CISA and CISM. You get an honest picture of your readiness and no surprises in the audit room.
Also delivered alongside
- ISO 22301 business continuity
- ISO/IEC 27017 / 27018 cloud and cloud-privacy extensions
- ISO/IEC 27701 privacy
- ISO/IEC 42001 AI management
- UK Cyber Essentials Plus
- Third-party and vendor risk programmes
Typical timelines
Around 3 months
Smaller organisations (up to ~50 users) to certification audit
Around 4–5 months
Larger organisations (up to ~500 users, multiple sites)
Indicative. Your timeline is confirmed after the gap analysis.
Outcome
A certified, audit-ready ISMS that holds up at every surveillance audit, with minimal disruption to the business.
Often combined with
- Certification & complianceSOC 2 Type II readinessFrom scoping to a clean Type II report.Learn more
- Security leadershipCISO as a ServiceAn experienced CISO embedded in your organisation on a monthly retainer.Learn more
- Certification & complianceAI governance (ISO/IEC 42001)An AI Management System, AI risk assessment and LLM security testing.Learn more
Frequently asked questions
What is ISO/IEC 27001 and why do we need it?
It is the globally recognised standard for information security management systems. It shows customers, partners and investors that you manage information security risk systematically, and enterprise customers and tenders often require it.
How long does certification take?
It depends on your size, scope and current maturity. As a guide, smaller organisations (up to about 50 users) typically reach the certification audit in around 3 months, and larger, multi-site organisations (up to about 500 users) in around 4–5 months. We confirm your timeline after the gap analysis.
What does certification require?
A defined ISMS scope, a risk management framework, a Statement of Applicability, documented policies and controls, monitoring, an internal audit, a management review and senior management commitment, followed by a Stage 1 and Stage 2 audit by an accredited certification body.
Is ISO 27001 suitable for small companies?
Yes. The standard applies to organisations of any size and sector. We scale the ISMS to fit your organisation.
Do you also handle the surveillance audits?
Yes. Most consultancies leave after the certificate. We run the annual surveillance and recertification cycle.
Are certification body fees included?
No. Fees charged by the certification body are separate from our fees.
Can we do ISO 27001 and SOC 2 together?
Yes. We map one control set to both, so evidence is collected once and used twice.
Ready for your free consultation?
Tell us about your security and compliance goals. Within 24 hours of our first conversation, we'll send you a detailed, cost-effective offer tailored to your needs.