ISO/IEC 27001 Consulting

Support in building and improving information security management systems under ISO/IEC 27001.

An ISMS that works in daily practice.

ISO/IEC 27001 specifies requirements for an information security management system. At its core is a risk-based approach: risks are assessed, appropriate controls defined and their effectiveness reviewed regularly.

We support you from the initial assessment to preparing for the certification audit – so that your ISMS does not only exist on paper but is carried by your organisation.

Topics

ISMS
Scope, roles, responsibilities and processes of the management system.
Risk assessment
Identifying and evaluating information security risks with a traceable method.
Risk management
Risk treatment, decisions by risk owners and the Statement of Applicability.
Policies
Policies of appropriate scope – understandable for the people who apply them.
Technical and organisational controls
Selecting and implementing Annex A controls in line with your risks.
Documentation
Controlled documents and records an auditor can verify.
Audit preparation
Internal audit, management review and preparation for the certification audit.
Continual improvement
Metrics, corrective actions and regular review after certification.

Approach

  1. Initial assessment

    Gap analysis against ISO/IEC 27001:2022 including Annex A.

  2. Scope and risks

    Defining the scope, risk assessment and risk treatment plan.

  3. Controls and documentation

    Implementing prioritised controls, policies and the Statement of Applicability.

  4. Review and prepare

    Internal audit, management review and preparation for the certification audit.

What you get

  • Gap analysis with a prioritised action plan
  • Risk assessment and Statement of Applicability (SoA)
  • Policies and procedures of appropriate scope
  • Support up to the certification audit

Certification itself is carried out by an accredited certification body. We support the preparation; we cannot guarantee a particular audit outcome.

Let us talk about your ISMS.

Whether it is a secure development process, an ISMS, preparing for the Cyber Resilience Act or controlled use of AI: a first conversation clarifies where you stand and which next step makes sense.

Get in touch