ISO/IEC 27001 Readiness
End-to-end ISO/IEC 27001:2022 readiness — from gap analysis through Statement of Applicability, risk treatment, control implementation, and internal audit.
- Outcome
- A cert-ready ISMS. Not paper compliance.
- Timeline
- 4 phases3–4 weeks · 6–8 weeks · 3–6 months · 3 weeks
- Mapped to
- ISO/IECNIST
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
We help you build the information-security management system an ISO 27001 auditor certifies, so it works in practice and passes.
- A customer or tender requires ISO/IEC 27001 certification
- You want one framework that answers most security questionnaires
- You're selling into regulated or enterprise markets
- You have security practices but nothing documented or audited
- You only need a risk picture for now, not certificationSecurity Risk Assessment
- Your main exposure is AI systemsISO/IEC 42001 Readiness
- Leadership sponsor and an internal owner
- Scope: which teams, sites and products
- Existing policies, asset lists and risk records
Still not sure? Take the 2-minute check
What you walk away with.
- A complete Statement of Applicability, justified per Annex A control
- A Risk Treatment Plan aligned to ISO 27005 methodology
- Internal Audit + Management Review — Clause 9 evidence
- A certification-body-ready evidence package
What we cover
Agreed in writing before testing starts.
- Full 2022 Annex A control set (93 controls, 4 themes)
- Clauses 4–10: Context, Leadership, Planning, Support, Operation, Performance, Improvement
- Statement of Applicability + Risk Treatment Plan
- Internal Audit Programme (Clause 9.2) execution
- Management Review evidence pack (Clause 9.3)
- Documentation set — every policy, procedure, standard, record
- Third-party certification-body engagement (they audit independently)
How we run it.
- 01
Gap analysis
Where you are vs where ISO 27001:2022 expects you. Every clause, every Annex A control.
- 02
ISMS scoping
Physical, logical, and organizational scope of the ISMS. Wrong scope kills more ISO 27001 projects than any control gap.
- 03
Risk treatment
ISO 27005-methodology risk assessment, treatment plan, and SoA. Evidenced to a defensible standard.
- 04
Control implementation
Design + implement missing controls with your teams. We build with you, not for you.
- 05
Internal audit + review
Clause 9.2 internal audit executed, non-conformities logged, Management Review packet delivered.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- ISO/IEC 27001:2022 clauses 4–10
- Annex A: 93 controls in 4 themes
- Statement of Applicability
- Risk assessment and treatment plan
- Policies people actually follow
- Evidence collection set up from day one
- Internal audit
- Management review
- Stage 1 and Stage 2 audit preparation
- We prepare you; an accredited body certifies
- No conflict between advice and audit
- Auditor-ready evidence pack
What lands in your inbox.
- ISO/IEC 27001:2022 Gap Analysis
- ISMS Scope Statement
- Statement of Applicability
- Risk Treatment Plan
- Full documentation set (policies, procedures, records)
- Internal Audit Report + Management Review packet
Defensible under audit.
- ISO/IEC
- NIST
From call to report.
- 01Gap analysis
3–4 weeks
- 02ISMS design + risk treatment
6–8 weeks
- 03Control implementation support
3–6 months
- 04Internal audit + Management Review
3 weeks
Asked before every engagement.
How long until we can be certified?
Typically 6–9 months from kickoff to Stage 1 audit-ready. Faster paths exist for smaller orgs; slower ones for complex, distributed estates.
Do you help us pick a certification body?
Yes — we advise on accredited CBs (UKAS, ANAB, etc.) and manage introductions. We take no referral commissions.
How is this different from a Security Risk Assessment?
An SRA is one-shot risk quantification. ISO 27001 is a management system with continuous governance. If certification is your goal, this is the engagement.
Ship an ISO-defensible ISMS.
Scoping call, program plan within 2 weeks, first internal audit inside 6 months for well-scoped orgs.