The scope of the system
Defining the scope correctly is one of the most important decisions in the project. It determines which processes, locations and systems are covered by the ISMS and, therefore, by the certification.
ISO 27001 Consultancy
ISO 27001 consultancy to implement and certify your ISMS.
We help you build a risk-based information security management system, proportionate to your organisation and ready to pass the certification audit.
- ISO/IEC 27001:2022
- Risk-based approach
- Implementation and maintenance
Information security is not an isolated technology project: it is a management system that involves leadership, processes and people.
Risk-based
Controls respond to real risks, not to a generic checklist.
Proportionate
Documentation and effort scaled to the size of the organisation.
Maintainable
A system the team can manage once certified.
What ISO 27001 consultancy involves
Implementing ISO 27001 means defining how the organisation identifies, assesses and treats risks to the information it manages: customer data, internal information, systems and services.
As ISO 27001 consultants, we support the whole process: from defining the scope to preparing for the certification audit, working with the people responsible for each area so the system fits the way the organisation actually works.
The standard
What is ISO 27001?
ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system (ISMS). The current version dates from 2022.
The standard combines management requirements (context, leadership, planning, support, operation, evaluation and improvement) with a reference set of controls set out in Annex A, organised into four themes.
A.5
Organisational
Policies, roles, asset management, suppliers and incidents.
A.6
People
Screening, awareness, training and responsibilities.
A.7
Physical
Protection of premises, equipment and media.
A.8
Technological
Access control, encryption, backups, monitoring and secure development.
Who it is suited to
ISO 27001 is applicable to any organisation, regardless of size or sector. It is especially relevant when:
Clients or tenders require it
More and more contracts and procurement processes ask for evidence of security management.
You handle sensitive information
Personal data, customer information or business-critical knowledge.
You provide technology services
Software companies, cloud services, IT support or outsourcing providers.
You want to bring order to security
Moving from scattered measures to a coherent, reviewable system.
Benefits of implementing an ISMS
- Demonstrable trust
- An internationally recognised certification for clients and partners.
- Risks under control
- Security decisions made with clear criteria and priorities.
- Defined responsibilities
- Everyone knows what they are accountable for in terms of security.
- Better incident response
- Procedures in place before anything happens.
- A base for other requirements
- Helps align with other frameworks and data protection obligations.
- Continual improvement
- The system is reviewed and updated on a regular basis.
Services related to ISO 27001
We can support the whole project or get involved in specific phases.
- Implementation
Full ISMS implementation
From the initial diagnosis to preparation for the certification audit.
- Diagnosis
Gap analysis
Assessment of the current situation against the requirements of the standard.
- Risk
Risk analysis and treatment
Methodology, identification of assets and threats, and a treatment plan.
- Audit
ISO 27001 internal audit
Review of the system ahead of the external audit or as part of the maintenance cycle.
- Maintenance
System maintenance
Ongoing support to review risks and indicators and prepare for surveillance audits.
- Transition
Transition to the 2022 version
Updating systems based on the previous version of the standard.
Implementation process
How we implement ISO 27001
A phased journey with clear deliverables at each stage.
- 01
Diagnosis and scope
We understand the context and interested parties and define the scope of the ISMS.
Diagnosis report - 02
Risk analysis
We identify assets, threats and vulnerabilities and assess the risks.
Risk register - 03
Treatment and SoA
We select controls from Annex A and justify their applicability.
Statement of Applicability - 04
Implementation
We develop policies, procedures and controls and train the team.
Operating system - 05
Internal audit and review
We verify the system and management formally reviews it.
Audit report - 06
Certification
We support the audit stages with the certification body you choose.
Audit support
Scattered measures or a management system
The difference between having security measures and managing security.
| Without an ISMS | With an ISO 27001 ISMS |
|---|---|
| Measures decided on a case-by-case basis | Controls derived from a risk analysis |
| Unclear responsibilities | Assigned roles and responsibilities |
| Scattered or non-existent documentation | Controlled, up-to-date documentation |
| Reviewed only when a problem arises | Regular audits and reviews |
| Hard to demonstrate to third parties | Evidence verifiable by a certification body |
Frequently asked questions about ISO 27001
What is the difference between implementing and certifying ISO 27001?
Implementation means putting the management system in place within the organisation. Certification means that an independent certification body audits the system and verifies that it complies with the standard. The consultancy supports implementation and preparation; certification is issued by the certification body.
How long does implementation take?
It depends on the scope, the size of the organisation and the starting point. After the initial diagnosis, we propose a timeline tailored to each case.
How long is the certificate valid for?
The usual certification cycle is three years, with periodic surveillance audits and a renewal audit at the end of the cycle.
Do we need our own IT department?
Not necessarily. The standard can also be applied when technology services are outsourced; in that case, supplier management becomes more important.
Can it be integrated with ISO 9001 or other standards?
Yes. ISO management system standards share a common structure, which makes it possible to integrate requirements such as policy, objectives, internal audits and management review.
ISO 27001 implementation: key aspects
Risk analysis as the core
ISO 27001 does not impose a fixed list of measures. It requires the organisation to apply a consistent risk assessment methodology and for the chosen controls to respond to the risks identified.
The Statement of Applicability
The Statement of Applicability (SoA) sets out which Annex A controls are applied, which are excluded and why. It is a central document that the auditor will review in detail.
Let's start from where you are.
Tell us about your current situation and we will propose how to approach your ISO 27001 implementation.