ISO 27001 Certification and ISMS Consulting

Flow chart of the ISO 27001 engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Gap Assessment. We define what your ISMS covers, then measure your current state against every clause and Annex A control. You get a clear picture of the work ahead. Activities: Define the ISMS scope and boundaries; Interview control owners across teams; Assess maturity against clauses 4 to 10; Test current state against the 93 Annex A controls; Rank gaps by effort and risk. Hands over Gap Assessment Report. Phase 2, Risk Assessment and Treatment. We run a structured risk assessment and agree how you treat each risk. This feeds your Statement of Applicability and risk treatment plan. Activities: Build the asset and risk inventory; Score risks by likelihood and impact; Agree treat, tolerate, transfer, or terminate for each; Select applicable Annex A controls; Draft the Statement of Applicability. Hands over Risk Treatment Plan and Statement of Applicability. Phase 3, Control Design and Documentation. We design the policies, procedures, and controls you need. Everything maps back to a clause or an Annex A control so nothing is orphaned. Activities: Draft the information security policy set; Write procedures for access, change, and incidents; Map every document to a clause or control; Define roles and the risk acceptance criteria. Hands over ISMS Policy and Procedure Set. Phase 4, Implementation Support. We help you roll out controls and start collecting evidence. You build the day-to-day habits that keep the ISMS running. Activities: Roll out controls across in-scope systems; Configure a compliance platform for evidence; Run security awareness training; Start access reviews and log collection. Hands over Operating Controls and Evidence Trail. Phase 5, Internal Audit and Management Review. We run an internal audit, log findings, and prepare your management review. This is your dress rehearsal before the certification body arrives. Activities: Plan and run the internal audit programme; Log nonconformities and corrective actions; Prepare management review inputs; Verify remediation before certification. Hands over Internal Audit Report and Management Review Record. Phase 6, Certification and Surveillance. We support you through Stage 1 and Stage 2 audits, then help you sustain the ISMS across annual surveillance visits. Activities: Prepare evidence for the Stage 1 documentation review; Support the Stage 2 certification audit; Close any audit findings raised; Plan annual surveillance and continual improvement. Hands over ISO 27001 Certificate. Each phase begins from the artefact the phase before it produced.