ISO 27001 Readiness & Certification Support

What we assess

We evaluate management-system requirements and risk-based control selection, rather than treating Annex A as an isolated checklist. The program links business context, risk assessment, treatment decisions, the Statement of Applicability, and operating controls. Internal audit and management review help demonstrate that the system is maintained.

Evidence to prepare

• ISMS scope, information security objectives, risk assessment, and treatment plan.
• Statement of Applicability with inclusion and exclusion rationale.
• Control records, internal audit findings, management-review decisions, and corrective actions.

Keep design evidence separate from operating evidence. An approved procedure shows how a control is designed; dated records show whether it ran consistently over the review period. Evidence should identify its source, owner, scope, and collection date.

What you receive

• ISMS readiness assessment and risk-based implementation roadmap.
• Control and evidence mapping to support audit preparation.
• Internal audit preparation and Stage 1 / Stage 2 certification coordination within the agreed scope.

Common questions

Do we need every Annex A control?

Control selection follows risk treatment and applicable obligations. The Statement of Applicability records the selected controls and explains exclusions; the decision must be justified for your scope.

What determines the engagement timeline and cost?

The system boundary, number of entities and locations, existing control maturity, evidence availability, and assessment pathway determine the effort. Share your customer requirements and target milestone so we can define a realistic scope before proposing a schedule.