ISO 27001, Built for Your Size
We build an information security management system (ISMS) that fits the size of your company — not a pile of documents nobody reads — and support you through certification.
The International Standard for Information Security
ISO/IEC 27001 is the international standard for an information security management system: a structured way to identify your information risks, decide how to treat them, and keep improving.
The current edition, ISO/IEC 27001:2022, lists 93 reference controls in Annex A, grouped into four themes: organisational, people, physical and technological. You apply the ones that address your risks and record the decision in a Statement of Applicability.
The certificate is issued by an accredited certification body after a two-stage audit, and is maintained through surveillance audits. Our role is to build the system with you and prepare you for that audit.
An ISMS That Is Actually Used
Sized for a mid-market team, and implemented — not only written.
Scope and gap assessment
We define what the ISMS covers and compare your current practice with the standard.
Risk assessment
Information risks identified and rated, a treatment plan, and the Statement of Applicability.
Policies and procedures
The required documents written for your company, in clear language your staff can follow.
Controls implemented
The technical controls put in place on your systems by engineers, not left as recommendations.
Internal audit and management review
The internal audit carried out and the management review prepared before the certification body arrives.
Certification audit support
We are with you through Stage 1 and Stage 2 and help close any findings.
The Path to Certification
Scope and gap assessment
What is in scope, and how far current practice is from the standard.
Risk assessment
Risks, treatment plan and Statement of Applicability.
Implementation
Policies written, controls implemented, staff made aware.
Internal audit
Internal audit and management review, with corrective actions closed.
Certification audit
Stage 1 and Stage 2 with the certification body you choose.
Questions Clients Ask
You May Also Need
NCA ECC Compliance
Gap assessment, implementation and evidence for the NCA Essential Cybersecurity Controls.
Learn more →Security Awareness Training
Managed phishing simulation and training programmes, delivered as a KnowBe4 partner.
Learn more →SACS-210 Certificate Renewal
We update your controls, rebuild the evidence report and attend the audit before your certificate expires.
Learn more →SACS-210 Certificate — Full Guide
The 33 requirements, the certification process, the audit session and validity.
Learn more →Start With an ISO 27001 Gap Assessment
We tell you how far you are from certification, and what it takes.