ISO 27001 certification, without the theatre
Gap assessment against Annex A, an ISMS your people will actually use, the evidence pack, and an engineer with you at Stage 1 and Stage 2.
The standard that everyone asks for by name
ISO/IEC 27001 certifies an information security management system — a way of running security, not a list of products. That is why buying tools does not get you certified.
- Scope definition — what the ISMS covers, and just as importantly what it does not
- Risk assessment and a risk treatment plan that maps to real decisions
- The Statement of Applicability, justifying every Annex A control you include or exclude
- Documented policies, procedures and records that survive being read by a stranger
- Internal audit, management review and corrective action running as a cycle
- The 2022 revision reorganised Annex A into 93 controls across four themes — organisational, people, physical and technological
From gap to certificate
1. Gap assessment
Every clause and every applicable Annex A control, assessed against what you actually do. You get a gap register, an effort estimate and an honest view of the timeline.
2. Build the ISMS
Scope, risk methodology, treatment plan, Statement of Applicability, and the policy set. Written for your organisation, not lifted from a template pack.
3. Fix the technical gaps
Access control, logging and monitoring, backup, cryptography, endpoint, supplier security, physical. We are an IT services company — we implement rather than recommend.
4. Internal audit and review
We run the internal audit, close the findings, and take management through review so the records exist before the certification body asks for them.
5. Stage 1 and Stage 2
We attend both. Stage 1 checks the documentation is there; Stage 2 tests whether it is real. We answer the questions and produce the evidence.
6. After the certificate
Surveillance audits come round every year. We keep the cycle running so year two is not a rebuild.
Common questions
How long will it take?
Three to six months is realistic for a mid-sized organisation, provided the remediation work is actually resourced. The gap assessment tells us which end of that range you are at.
Do we need to certify the whole company?
No. Scope is a decision, and a well-chosen scope makes certification faster and cheaper. Many organisations certify a specific service, site or business line first.
We already have policies. Does that help?
Sometimes. Policies nobody follows are worse than none, because an auditor will test them. We will tell you which ones to keep.
Who issues the certificate?
An accredited certification body, not us. We prepare you and stand beside you through their audit.
Find out how far away you are.
A gap assessment gives you a real timeline and a real cost before you commit to anything.
02 3537 5791