ISO 27001 Consulting
We guide your organisation through ISO/IEC 27001 from first gap analysis to certification, building an information security management system that fits how you actually work and stands up to audit.
A working information security management system
ISO 27001 is not a box-ticking exercise, it is a management system your people have to live with. We help you design controls that match your risk, your size and your budget, then get you ready for the certification audit with no surprises.
Gap Analysis
A clear read of where your current practices sit against the ISO/IEC 27001 requirements and Annex A controls.
Risk Assessment
A structured method to identify, rate and treat the risks to your information assets, documented the way auditors expect.
Policies & Procedures
The documented information the standard requires, written in plain language your staff will actually follow.
Control Implementation
Practical rollout of the Annex A controls that apply to you, from access control to supplier management.
Awareness & Training
Staff briefings and role-based guidance so your team understands their part in keeping information secure.
Internal Audit & Review
A mock audit and management review to confirm you are ready before the certification body arrives.
Certification Is the Milestone. A Genuine Security Culture Is the Real Prize.
Plenty of firms chase the ISO 27001 certificate and end up with a folder of policies nobody reads. That gap between paperwork and practice is exactly where incidents happen. Customers, partners and regulators increasingly ask for proof that you manage information security properly, and a certificate that does not reflect reality will not survive the first serious audit or the first serious breach.
Our team works alongside yours to build a management system that reflects how your business really runs. We run the gap analysis, shape the risk assessment, draft the documentation with you rather than for a drawer, and prepare your people for the certification audit. You end up certified, and you end up with security habits that hold up long after the auditor has gone.
Standards and Frameworks We Work To
- Every engagement is built around ISO/IEC 27001:2022 and the Annex A control set, with supporting guidance from ISO/IEC 27002 for how each control is implemented.
- We align your risk assessment method with ISO/IEC 27005 so that risk decisions are consistent, repeatable and defensible in front of an auditor.
- Where your business answers to other obligations, such as GDPR or sector regulation, we map your controls across so a single system serves more than one requirement.
Aligned to the frameworks that matter
Our testing follows the methodologies that set the global standard for application security.