Compliance-first delivery
From gap analysis to certification-ready
ISO 27001 is often the price of entry for enterprise and international deals, but many first attempts go wrong in one of two ways: a template ISMS that nobody follows and that falls apart under audit questioning, or an over-engineered program that consumes engineering time for a year. Since the 2022 revision, organisations also need to work to the updated Annex A with its 93 controls.
We build an ISMS sized to your organisation. That means a clear scope, a risk assessment your leadership actually understands, a Statement of Applicability that justifies each control, and policies written around how your teams already work. We implement the technical controls alongside your engineers — access management, logging, backup, secure development, supplier management — using the same practical approach as our security and compliance work, and run an internal audit and management review before the certification body arrives. Our ISO 27001 readiness checklist shows what the journey involves.
You go into Stage 1 and Stage 2 audits with a working ISMS, organised evidence and people who can explain it. Risks, controls and evidence can be maintained in our GRC platform so surveillance audits are routine. If you also need SOC 2 or HIPAA, we map the same controls through our multi-framework compliance service. Certification itself is issued by an accredited certification body; we prepare you for it.
- Gap analysis against ISO/IEC 27001:2022 and its Annex A
- Right-sized ISMS scope, policies and Statement of Applicability
- Risk assessment and treatment plans leadership can own
- Technical control implementation alongside your engineers
- Internal audit and Stage 1 / Stage 2 audit preparation
What's Included
Everything you need, delivered by a senior, security-first team.
Gap Analysis
Clause-by-clause and Annex A review with a prioritised remediation plan.
ISMS Build
Scope, context, objectives, policies and procedures tailored to your organisation.
Risk Management
Asset and risk register, treatment plans and Statement of Applicability.
Control Implementation
Access, logging, backup, supplier and secure-development controls put into practice.
Internal Audit
Independent internal audit and management review ahead of certification.
Certification Support
Evidence preparation and support through Stage 1, Stage 2 and surveillance audits.
ISO 27001, done properly
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Certification, issued by an accredited certification body after an independent audit, shows customers and partners that you manage information security risk systematically. The current version, ISO/IEC 27001:2022, organises its Annex A reference controls into 93 controls across four themes: organisational, people, physical and technological. We help organisations build an ISMS that genuinely works and prepare for the certification audit — the audit itself is always performed by an independent, accredited certification body.
What the standard requires
- Clauses 4–10 — the management system: context and scope, leadership, risk assessment and treatment, resources and competence, operation, performance evaluation (monitoring, internal audit, management review) and continual improvement.
- Annex A — the reference set of controls. You select controls based on your risk assessment and justify inclusions and exclusions in a Statement of Applicability.
The path to certification
| Phase | Key activities | Outputs |
|---|---|---|
| 1. Gap analysis | Assess current practices against clauses and Annex A | Gap report and roadmap |
| 2. ISMS foundation | Scope, policy, roles, risk methodology | ISMS scope, information security policy, risk method |
| 3. Risk assessment | Identify assets, threats, vulnerabilities; evaluate and treat risks | Risk register, treatment plan, Statement of Applicability |
| 4. Implement controls | Technical and organisational controls, procedures, training | Operating controls and evidence |
| 5. Operate and measure | Run the ISMS, collect metrics | Records proving controls operate |
| 6. Internal audit and review | Independent internal audit, management review | Audit report, corrective actions |
| 7. Certification audit | Stage 1 (documentation) and Stage 2 (effectiveness) by the certification body | Certificate, then surveillance audits |
How we help
We run the gap analysis, facilitate risk workshops, write right-sized policies and procedures, implement technical controls in your cloud and endpoints, set up evidence collection, train staff, conduct the internal audit and support you through the Stage 1 and Stage 2 audits. Our GRC Platform can hold the risk register, Statement of Applicability, policies and evidence in one place, and our GRC and risk management service helps you run it.
Moving from ISO 27001:2013 to 2022
The 2022 revision consolidated the old 114 Annex A controls into 93, added new controls such as threat intelligence, cloud services security, data masking, data leakage prevention, monitoring activities and secure coding, and introduced attributes for organising controls. Organisations certified to the 2013 version needed to transition by the end of October 2025. We map existing controls to the new structure and fill the gaps.
Common pitfalls
- Scoping too broadly at first, multiplying effort. A focused scope can be extended later.
- Buying a template pack and adopting policies nobody follows.
- Treating risk assessment as a spreadsheet exercise disconnected from real decisions.
- Not running the ISMS long enough to generate evidence before the Stage 2 audit.
- Skipping management review — auditors check that leadership is genuinely involved.
Our article ISO 27001 Readiness: What Gets You Certified goes into these in detail.
ISO 27001 alongside other frameworks
ISO 27001 controls overlap heavily with SOC 2, HIPAA and GDPR, so one programme can serve several — see HIPAA, GDPR and SOC 2 compliance. Annex A expects technical testing too; our VAPT services provide the penetration test evidence, and our security and compliance programme work covers the technical controls.
Your Path to ISO 27001 Certification
Gap Assessment
Understand scope, current controls and the work required; agree a realistic timeline.
Build the ISMS
Risk assessment, Statement of Applicability, policies and control implementation.
Operate & Audit
Run the ISMS, collect evidence, then perform internal audit and management review.
Certify
Support through Stage 1 and Stage 2 with your chosen certification body, then surveillance.
Frequently Asked Questions
It depends on your size, scope and starting point. Smaller organisations with good security basics can often be audit-ready within a few months; larger or less mature organisations take longer. The ISMS must also run for long enough to produce evidence before the Stage 2 audit.
No. Certification is issued only by an accredited, independent certification body after its audit. We prepare you for that audit and support you through it, and we can help you select a certification body.
Annex A of ISO/IEC 27001:2022 lists 93 reference controls in four themes: organisational, people, physical and technological. You apply the controls relevant to your risks and justify the selection in a Statement of Applicability.
Our gap analysis is fixed-price. Implementation support is priced by scope and how much you want us to do versus your team. Certification body audit fees are separate and paid directly to the certification body.
Yes. Most controls overlap, so we build one control set and map it to both, collecting evidence once.
Book a free consultation. We discuss your drivers and scope, then propose a gap analysis that ends with a clear roadmap.
Ready to get started with ISO 27001 Compliance?
Book a free consultation — we'll map a secure, practical path forward.