ISO 27001 certification, without the paper chase.
We build an information security management system your team will actually use, and take it through to the certification audit. An accredited certification body issues the certificate; we make sure you are ready for it.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day
Usually, one of these is true.
We do not issue ISO certificates and we do not choose your certification body for you. We can help you compare quotes.
- Enterprise or public-sector customers, especially in the EU, ask for it in tenders and security questionnaires.
- You want one recognised standard to answer many customers instead of a new questionnaire every time.
- An insurer, investor or board has asked for independent proof that security is managed, not just claimed.
- You already run NIST CSF, SOC 2 or HIPAA controls and want to reuse the work.
ISO 27001 at a glance
| Topic | What to know |
|---|---|
| The standard | ISO/IEC 27001:2022. Management-system clauses 4 to 10, plus Annex A with 93 controls in four themes. |
| Who certifies | An accredited certification body of your choice, in two stages. It is independent of us, which keeps the result credible. |
| Certificate cycle | Three years, with surveillance audits in between. |
| What you keep | A working ISMS: risk register, Statement of Applicability, policies, internal audit and management-review records. |
From first gap review to certificate.
Scope and gap assessment
Agree what the certificate will cover, then compare what you do today with the clauses and Annex A controls.
Risk assessment and treatment
Build the risk register and decide, control by control, what applies. This produces the Statement of Applicability auditors start from.
Build the ISMS
Policies, roles, procedures and evidence, kept proportionate to your size so people can follow them.
Internal audit and management review
The two records auditors always ask for, run and written up before the real audit.
Certification audit support
We prepare your team, liaise with the certification body through both stages, and track any findings to closure.
Deliverables you can hand to an auditor.
Scoped on the free call and agreed as a fixed fee. Start with an Assess project, then Build and Manage as you need them.
- Gap assessment against ISO/IEC 27001:2022
- Scope statement, risk register and Statement of Applicability
- Policy and procedure set sized to your organisation
- Internal audit and management-review packs
- Audit preparation and findings tracking
- A control map that also covers NIST CSF 2.0, SOC 2 and NIS2
Questions about ISO 27001.
Do you certify us?
No. Certification is done by an accredited certification body that you appoint. We lead the readiness work and support you through the audit, which keeps the audit independent.
How long does it take?
It depends on your starting point, your size and how much of the control set already exists. On the free call we give you a realistic range for your situation rather than a generic number.
Can the work be reused for SOC 2 or NIS2?
Largely, yes. Much of the control evidence overlaps, so we build one control set and map it to each framework rather than starting again.
Do we need a compliance platform?
Not necessarily. We work with the platform you already use or with simple, well-organised documents, whichever suits a team of your size.
Related: SOC 2 readiness · NIS2 for US and EU groups
Start with a free conversation about ISO 27001.
A free 30-minute conversation to agree what matters most and what to do first. If you would like to prepare, answer the short questionnaire beforehand.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day