ISO & Compliance Advisory
ISO 27001 consulting, without the theatre.
ISMS work that produces a system the business can actually operate, not a binder written for an auditor and never opened again. From gap assessment to internal audit and certification readiness.
- Practice
- ISO & Compliance
- Standard
- ISO/IEC 27001
- Covers
- Gap, ISMS, audit, readiness
- Delivery
- Senior, direct
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, risk process, controls and evidence an organisation uses to manage information security. Certification is awarded by an accredited certification body after an external audit.
Our role is to get you ready for that audit with a system that keeps working afterwards: risk assessment grounded in business impact, controls that fit how your teams already work, and evidence gathered as you go rather than at audit time.
Who it is for.
- Organisations whose customers or tenders ask for ISO 27001
- Teams starting an ISMS from scratch or rebuilding one that stalled
- Certified organisations that need an independent internal audit
- Companies extending into privacy (ISO 27701) or AI (ISO/IEC 42001) management
What we do.
ISO 27001 gap assessment
Where you stand against the standard's requirements and controls, and what it will take to close the gap.
ISMS implementation
Scope, risk assessment and treatment, Statement of Applicability, policies and procedures, built around how your organisation actually operates.
Risk management
Identify, assess and prioritise information-security risks based on business impact.
Internal audit
An independent internal audit of the ISMS, as the standard requires before certification and each year after.
Audit readiness
Control gap closure, evidence preparation and support through the certification body's audit.
What actually arrives.
An engagement that ends at a slide deck leaves you with an opinion. These are the artefacts this one produces.
Gap assessment report
Current state against the standard, with a prioritised plan to close each gap.
ISMS documentation
Scope, policies, risk methodology, risk register, Statement of Applicability and procedures, written to be used.
Internal audit report
Findings and corrective actions ahead of the external audit.
Evidence pack
The records an auditor will ask for, organised and current.
Frequently asked questions.
- Do you issue ISO 27001 certification?
- No. Certification is issued by an accredited certification body after its own audit. We prepare you for that audit and can support you through it.
- Can you help if we already have some security policies?
- Yes. The gap assessment starts from what you already have and only adds what the standard and your risks actually require.
- Can ISO 27001 work be combined with ISO 42001 or ISO 27701?
- Yes. They share the same management-system structure, so an AI or privacy management system can be built on the ISMS rather than beside it.
- Do you map controls to other frameworks?
- Yes. Security programmes are also assessed against NIST CSF and NIST 800-53 where customers or regulators ask for them.
Next step
Talk to us about ISO 27001 Consulting.
Start with a scoping conversation.
Describe the system and the decision you need to make. You will get a practitioner's view of where the risk actually sits, and what the engagement should cover, before anything is scoped.