Governance, Risk & Compliance
An ISO 27001 certificate is worth exactly as much as the management system behind it. We build that system with you, run the risk treatment, and get you through Stage 1 and Stage 2 — but the certificate itself comes from an accredited certification body, not from us. Anyone telling you otherwise is selling you a worthless piece of paper.
ISO/IEC 27001:2022 does not certify that your systems are secure. It certifies that you run an Information Security Management System — that you have decided what your controls are, assigned them to owners, assessed the risks they address, and can demonstrate that the whole thing operates and improves. That distinction matters, because it explains why the auditor spends more time on your risk register and your management review minutes than on your firewall rules.
This is also why the certificate is the easy part and the second year is hard. Enough templates and enough overtime in the month before Stage 2 will get most organisations through a first audit. The surveillance audit twelve months later is where programmes fall over, because the same evidence has to be produced again by people who were not there the first time, from a shared drive full of undated screenshots.
We build for the surveillance audit rather than the certification audit. Controls should produce their own evidence as a by-product of operating — access reviews that log themselves, vulnerability scans with their own history, change approvals that live where changes actually happen. And because our testing feeds the same risk register, a penetration test finding and a control failure are one object rather than two teams’ separate problems.
Coverage
The 2022 edition replaced the 2013 edition’s fourteen domains with 93 controls across four themes. Your Statement of Applicability — which controls apply, which do not, and why — is the first document any certification auditor opens.
Policies, roles and responsibilities, supplier and cloud-service relationships, incident management, business continuity, threat intelligence and the legal and regulatory register. The largest theme by count, and the one most often under-documented.
Screening, terms of employment, awareness and training, the disciplinary process, remote working and confidentiality agreements. Small in number, disproportionately common as a nonconformity.
Secure areas, equipment siting and protection, clear desk and clear screen, secure disposal and media handling. Routinely skipped by cloud-only teams, and still assessed — a co-working desk and an unlocked laptop are in scope.
Access control, cryptography, logging and monitoring, malware protection, data leakage prevention and secure development (A.8.25–A.8.29). This is where independent testing evidence goes straight into the file rather than being asserted.
The management-system requirements that are not in Annex A at all: context, leadership, planning, support, operation, performance evaluation and improvement. Certification is failed here more often than on a technical control.
Which entities, sites, systems and services are being certified, and what is legitimately excluded. This single decision is the largest lever on both cost and audit duration, and it is the first thing we settle.
Approach
A first certification typically takes four to nine months, driven by starting position and scope rather than by headcount. The certification body also needs Stage 1 and Stage 2 booked with a gap between them, which is calendar time you cannot compress.
What is being certified, and where you stand against all 93 controls and clauses 4–10. Every gap is costed in effort with an owner, so the programme can be planned rather than discovered.
A risk register your management team can actually discuss, using a documented and repeatable methodology, fed by real findings from testing rather than a hypothetical threat list.
The SoA justified control by control, plus the policy set — written for how your organisation works, not a renamed template pack with someone else’s company name still in the footer.
Controls built and actually run: access reviews performed, logs reviewed, suppliers assessed, incidents exercised. Evidence collection automated wherever the platform can carry it.
Both are mandatory under clause 9 before you can go external. We run them as a genuine dry run, so nonconformities surface with us rather than with your auditor.
We support Stage 1 and Stage 2 and answer the technical questions in the room. Then continuous monitoring, so year two is a review rather than a rebuild.
Deliverables
The report is the product. If it cannot be acted on by a developer and understood by a director, we have not finished.
Every gap against all 93 controls and clauses 4–10, with an effort estimate and a named owner — an honest baseline, not an inflated readiness percentage.
Live, owned and reviewable. The document auditors examine most closely and that clients maintain worst.
Justified control by control, with inclusions and exclusions defensible on their own terms and mapped to the evidence that supports them.
Access, incident, continuity, supplier, cryptography, development and HR security — in language your staff will actually follow.
Run properly and documented properly, in the form certification bodies accept.
We are in the room for Stage 1 and Stage 2, and we take the technical questions so your team does not have to.
Is this for you?
If none of them are, say so on the call and we will tell you honestly whether this is the right piece of work — or point you at the one that is.
Book a scoping callHow we work
The same engagement model applies to every piece of work we take on, so you always know what happens next.
A 30-minute call, then a written scope: what is in, what is out, what we need from you and what it costs. Nothing starts before you sign it.
Rules of engagement, testing windows, escalation contacts and a signed authorisation. Out-of-hours windows where production cannot take the load.
Automated coverage first, then manual testing where judgement is required. Critical findings are reported the day we confirm them, not at the end.
One report a developer can act on and an executive can read, with evidence, reproduction steps, business impact and a fix for every finding.
A walkthrough call with your engineers. We answer questions on the fix, not just the finding.
A free retest cycle to confirm the fixes hold, and a clean summary you can hand to a customer, auditor or board.
Questions
The questions clients actually ask during scoping. If yours is not here, ask it directly.
No, and no consultancy legitimately can. The certification audit must be performed by an accredited certification body that is independent of whoever implemented the management system. We implement the ISMS, run your internal audit and support you through the external audit — but the certificate is issued by the certification body on their own judgement. Any firm offering to both implement and certify is offering you something an informed customer will not accept.
Four to nine months for most organisations, driven by starting position and scope rather than company size. An organisation with reasonable IT discipline, a tight scope and an internal owner who can give it real time can be audit-ready in about four months. Starting from nothing, with a broad scope and no dedicated owner, plan for nine. Stage 1 and Stage 2 also have to be booked with a gap between them, which adds calendar time regardless of how fast you work.
It was withdrawn, and the transition period for certificates issued against it ended on 31 October 2025 (as of August 2026). Only the 2022 edition — 93 Annex A controls across four themes — is current. If anyone offers you a 2013-edition certification today, that is a reason to walk away rather than a shortcut.
The document that lists all 93 Annex A controls and records, for each one, whether it applies to your organisation and why. Inclusions have to be justified and so do exclusions. It is the first document a certification auditor reads, because it defines what they are auditing you against, and a weak SoA makes every subsequent conversation harder.
Two separate costs. The certification body charges its own audit fee based on scope and headcount, paid directly to them — we do not mark it up. Our implementation fee depends on how much of the work you absorb internally: an organisation with an existing IT function and an engaged owner pays considerably less than one needing the whole programme delivered. We scope properly and quote a fixed price rather than a day rate that grows.
It usually depends on who is asking. European, Indian and Middle Eastern enterprise buyers, and most tender processes, ask for ISO 27001. North American technology buyers ask for SOC 2. If you sell to both, start with ISO 27001 — it is a management system, so it gives you the structure — then add SOC 2, which is materially cheaper in that order than the reverse.
Not by statute for most sectors. It is increasingly mandatory commercially, which amounts to the same thing when a contract depends on it. It also gives you a defensible base for DPDP Act obligations around security safeguards and breach response, because the controls substantially overlap even though the legal duties are separate.
No. It makes you consistent, and consistency is a precondition for security rather than a substitute for it. A certified organisation has decided what its controls are and can show they operate. Whether those controls stop a competent attacker is a different question, and it is the one testing answers — which is why our findings feed the same risk register the ISMS runs on.
Next step
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.
