ISO 27001, from gap analysis to certificate.
We build your information security management system (ISMS) around ISO/IEC 27001:2022, choose the Annex A controls your risks call for, and get your team ready for the certification body's Stage 1 and Stage 2 audits.
- First certification:
- a gap analysis and a roadmap to the Stage 2 audit.
- Already certified:
- internal audits, SoA updates and surveillance readiness.
- Scope agreed in writing up front
- Risk assessment and Statement of Applicability built with your owners
- Internal audit and management review done before the certification body arrives
- Mapped to SOC 2, HIPAA and the frameworks you already run
What is ISO 27001, and what does it certify?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current edition is ISO/IEC 27001:2022. It is voluntary: no law requires it on its own, but an accredited certification body can audit your ISMS and issue a certificate that customers recognize worldwide.
The management system
- Context & scope
- Leadership
- Planning & risk
- Support
- Operation
- Performance evaluation
- Improvement
The controls
- 93 Annex A controls
- Organizational · 37
- People · 8
- Physical · 14
- Technological · 34
ISMS
Information Security Management System
The mandatory clauses 4 to 10, run with the Annex A controls your risks call for. This is what the certification body audits, within the scope you define.
You don't implement all 93 by default: the Statement of Applicability (SoA) records which controls apply, and why.
The three audits behind a certificate
Stage 1 audit
A documentation and readiness review: the auditor reads your scope, policy, risk methodology and Statement of Applicability, and flags anything to fix before Stage 2.
Stage 2 audit
The implementation audit: the auditor samples evidence, interviews staff and walks through controls. With no major nonconformities open, the certificate is issued.
Surveillance & recertification
The certificate is valid for three years. Surveillance audits follow in years one and two, and a recertification audit in year three.
Where your ISMS has to reach
- Cloud & infrastructure
- Applications & code
- Laptops & devices
- Suppliers & vendors
- People & HR
- Offices & sites
Whatever sits inside the scope is audited, including suppliers and people processes that are easily left out. Phase one of our program agrees the scope with you and maps each of these.
See all 93 Annex A controls, theme by theme, with what each one asksWho needs ISO 27001 certification?
No law requires ISO 27001 on its own. Organizations certify because customers, partners or regulators ask for proof that information security is managed, and a certificate from an accredited body gives that proof in one document.
01 · Your customers
Ask for proof
- Enterprise buyers
- Public and private tenders
- Partners and regulators
- Overseas markets
Send security questionnaires, and ask for an ISO/IEC 27001 certificate.
02 · Your organization
Runs the ISMS
- SaaS and cloud platforms
- Fintech vendors
- Healthtech
- IT and managed services
Certified against ISO/IEC 27001 by an accredited certification body.
03 · Your suppliers
Handle your information
- Hosting and cloud
- Software and tools
- Outsourced services
Covered by your supplier security controls and contracts.
If buyers keep sending you security questionnaires, a certificate answers the core question many of them ask.
It is an internationally recognized standard, often asked for by buyers in Europe, Asia and the Middle East and named in tenders. Selling mainly to US companies? Many ask for a SOC 2 report instead, or as well; we can map one set of controls to both.
How an ISO 27001 certification program works
Six phases, each with a named output and a clear ask of your team. The ISO 27001 gap analysis is the first phase on its own. The ISO 27001 certification program runs all six.
- Scope
Gap analysis & scoping
We agree the ISMS scope: the locations, teams, services and systems it covers. Then we compare how you work today with every clause of ISO/IEC 27001:2022 and the 93 Annex A controls, and rank the gaps.
- ISMS scope
- Asset & data-flow review
- Clause & control gaps
- Remediation roadmap
- You get
- Gap analysis report, scope statement and a prioritized roadmap.
- You provide
- A kickoff with leadership and the ISMS owner, existing policies, and walkthroughs of your systems.
- Assess
Risk assessment & Statement of Applicability
We set a risk methodology, build the asset register, assess threats and vulnerabilities, score each risk and decide its treatment. The controls that treatment needs go into the Statement of Applicability (SoA), with a reason for every exclusion.
- Risk methodology
- Asset register
- Risk scoring
- Treatment plan
- SoA
- You get
- Risk assessment report, risk treatment plan and SoA.
- You provide
- Asset and risk owners for each area, and decisions on how each risk is treated.
- Document
Policies & documentation
The information security policy, the topic policies and procedures your controls need, and document control so every document is versioned and approved. Written for how you actually work, not copied from a template.
- Security policy
- Topic policies
- Procedures & runbooks
- Document control
- You get
- Policy set, procedures and record templates.
- You provide
- Review and sign-off from the people who will own each document.
- Implement
Control implementation
We put the selected controls in place with your team: access control, logging and monitoring, backup and recovery, incident response, supplier security and the rest your SoA names, each with evidence that it operates.
- Access control
- Logging & monitoring
- Backup & recovery
- Incident response
- You get
- Controls running, with evidence an auditor can sample.
- You provide
- Engineering and IT time for the changes, and access to review them.
- Verify
Training, internal audit & management review
Security awareness for everyone and role training for ISMS owners. Then an internal audit of the whole ISMS, corrective actions for what it finds, and a management review with top management.
- Awareness training
- Internal audit
- Corrective actions
- Management review
- You get
- Training records, internal audit report and management review minutes.
- You provide
- Staff time for training, and top management for the review.
- Certify
Certification audit support
You choose an accredited certification body. We prepare your team and evidence for Stage 1, the documentation review, help close its findings, and support you through Stage 2, where the auditor checks the ISMS in operation.
- Stage 1 readiness
- Finding closure
- Stage 2 support
- Nonconformity response
- You get
- A team and evidence ready for audit. The certificate comes from the certification body.
- You provide
- Subject experts available on audit days.
No one-size timeline: it depends on your scope, size and existing controls. You get a firm timeline in writing before work starts.
What you receive
Everything the program produces lands in one audit file. Each item is paired with the auditor's question it answers at Stage 1 or Stage 2.
Each gap comes with the specific fix and a walkthrough with your team. We verify each fix and update the report, so closure is documented.
Only an accredited certification body issues the certificate. This file is what it audits: we prepare it, we don't certify it.
01, Scope phase: ISMS scope statement
The locations, teams, services and systems the ISMS covers, and the reasoning behind each boundary.
02, Scope phase: Gap analysis report & roadmap
Every clause and control assessed, the gaps ranked by risk, each with an owner.
03, Assess phase: Asset register
Information and assets in scope, each with an owner and a classification.
04, Assess phase: Risk assessment & treatment plan
Each risk scored by likelihood and impact, with an owner and a treatment decision.
05, Assess phase: Statement of Applicability
All 93 Annex A controls: applicable or not, the reason, and the implementation status.
06, Document phase: Policies & procedures
The information security policy and the topic policies and procedures your controls need, under document control.
07, Implement phase: Control evidence
Access reviews, logs, backup tests and change records, dated and ready to sample.
08, Verify phase: Training & competence records
Awareness and role training completions, dated and attributed.
09, Verify phase: Internal audit & management review
The internal audit findings, the corrective actions, and the minutes of the management review.
10, Certify phase: Stage 1 & Stage 2 readiness
Evidence indexed for the auditor, staff briefed for interviews, and Stage 1 findings closed before Stage 2.
Illustrative example, not client data
What one Statement of Applicability row looks like
- Control
- Information backup (Annex A, 8.13)
- Applicable
- Yes
- Reason
- Customer data in production databases; risk of data loss rated high
- Implementation
- Daily encrypted backups; restore tested every quarter
- Owner
- Head of Infrastructure
- Evidence
- Backup job report and a dated restore-test record
Four common ISO 27001 misconceptions
Each one sounds reasonable, and each one costs time at audit.
Assumption 01
Assumption: We have to implement all 93 Annex A controls.
What the standard says
Your risk assessment decides which controls apply. The SoA lists all 93 and gives a reason for each inclusion and exclusion, and auditors test those reasons, so an exclusion has to hold up.
Assumption 02
Assumption: We can get certified to ISO 27002.
What the standard says
There is no ISO 27002 certificate. ISO/IEC 27002 is guidance on implementing the same 93 controls; certification exists only against ISO/IEC 27001.
Assumption 03
Assumption: Our consultant will issue the certificate.
What the standard says
Only an accredited certification body issues it, after Stage 1 and Stage 2. A certification body can't also consult for a client it certifies, so the two roles are always separate.
Assumption 04
Assumption: Once we're certified, we're done.
What the standard says
The certificate lasts three years, with surveillance audits in years one and two and a recertification audit in year three. Internal audits, management reviews and risk updates become a yearly rhythm.
Heard one of these on your team? An ISO 27001 gap analysis shows what the standard actually asks of you.
Get an ISO 27001 gap analysisWhat you can hold us to.
We don't publish client logos or case studies; we keep our clients' security posture private. These are the commitments we make instead.
Our commitments
Experienced practitioners lead
Every engagement is led by experienced practitioners.
Peer review
Every deliverable is peer-reviewed before it reaches you.
Written scope and change control
You know what is covered, and what happens if scope changes, before work starts.
An ISMS your team can run
Policies and controls built for how you operate, that your team can maintain after we leave.
We engaged Auditify Security for their ISO/IEC 27001 compliance service, and it was a game-changer. Their team guided us through the entire process, from gap analysis to final certification.
Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.
Ask for a referenceISO 27001 questions buyers ask
Is ISO 27001 certification mandatory?
No law requires it on its own. Customers and tenders do.
ISO 27001 is a voluntary standard. You can run an ISMS without certifying, but customers, partners and tenders often ask for the certificate as independent proof, and that is what makes it necessary in practice.
ISO 27001, explained one question at a time.
Every ISO 27001 guide we publish: the basics of an ISMS, the controls and documents the standard expects, and the road to certification. Read them in any order.
The basics06
- What is an ISMS?The management system ISO 27001 certifies: policies, risk, controls, review.
- Information security policyThe top-level policy Clause 5.2 requires, and what makes one work.
- Access control explainedLeast privilege, RBAC vs ABAC, and the access reviews auditors test.
- An ISO 27001 implementation roadmapThe order of work from scope to certification audit.
- What ISO 27001 requires, in one placeEvery requirement at a glance, with the page that explains each.
- Who needs ISO 27001?The buyers, laws and situations that make it worth doing.
The standard05
- ISO 27001 Annex A controlsAll 93 controls in four themes, with what each one asks.
- ISO 27001 mandatory documentsWhat the standard requires you to document, clause by clause.
- ISO 27001 vs ISO 27002The requirements standard and the guidance standard, side by side.
- What ISO 27001 requires, in one placeEvery requirement at a glance, with the page that explains each.
- The Statement of ApplicabilityHow to build the document auditors open first.
Clauses 4 to 1012
- Clause 4: context of the organisationYour context, interested parties and the boundary of the ISMS.
- Writing the ISMS scope statementHow to draw the line and word it so an auditor accepts it.
- Clause 5: leadershipWhat top management must do, say and be able to show.
- Clause 6: planningRisks, objectives and planned change, as the standard sequences them.
- Risk assessment and treatmentA method that is repeatable, with the records an auditor reads.
- Clause 7: supportResources, competence, awareness and communication.
- Documented informationWhat to write, how to control it, and how little is enough.
- Clause 8: operationRunning the risk work you planned, and keeping the evidence.
- Clause 9: performance evaluationMeasuring, auditing and reviewing the system.
- The ISO 27001 internal auditWho may audit, what to test, and how to report.
- The management reviewThe inputs and outputs the standard lists, and a workable agenda.
- Nonconformity and corrective actionFrom a finding to a fix that holds, with root cause.
Annex A by theme04
- Annex A organizational controlsThe 37 controls of the first theme, grouped by what they do.
- Annex A people controlsThe 8 controls on hiring, training, and leaving.
- Annex A physical controlsThe 14 controls on sites, equipment and media.
- Annex A technological controlsThe 34 controls on systems, networks, code and data.
Controls auditors ask about14
- Supplier security controlsVetting, contracts and monitoring for the vendors you rely on.
- Cloud services securityChoosing, using and leaving a cloud service, under the standard.
- Incident management controlsPlanning, responding, learning, and the records between them.
- Continuity and ICT readinessRecovery objectives and tests, and what an auditor samples.
- Threat intelligenceThe newer control, and a proportionate way to meet it.
- Assets and information classificationThe inventory, owners, labels and handling rules.
- Security awareness and trainingWhat to teach, who to teach, and the proof.
- Technical vulnerability managementFinding, ranking and fixing weaknesses on a schedule.
- Configuration managementBaselines, drift and hardened builds.
- Backup and redundancyWhat to back up, restore tests, and spare capacity.
- Logging and monitoringWhat to log, how long to keep it, and who looks.
- Cryptography and key managementWhere to use it, who holds keys, and the policy behind it.
- Secure developmentFrom requirements to code review and testing.
- Change managementRequesting, approving, testing and recording change.
Putting it to work04
- How long an ISO 27001 certificate lastsThe cycle of audits, and what keeps a certificate valid.
- Penetration testing and ISO 27001What the standard expects, and what auditors accept.
- ISO 27001 and SOC 2 togetherRunning one programme for two audits.
- ISO 27001 for startupsA lean ISMS that still passes an audit.
ISO 27001 and Indian regulators06
- ISO 27001 and SEBI's cyber frameworkWhere the certificate helps a SEBI-regulated entity.
- ISO 27001 for IRDAI-regulated insurersInsurer security expectations next to the standard.
- ISO 27001 and RBI expectationsBanks, NBFCs and RBI requirements, mapped to the ISMS.
- ISO 27001 and CERT-In directionsIncident reporting and logging duties, and the ISMS.
- ISO 27001 and the DPDP ActHow the ISMS carries the Act's security safeguards duty.
- ISO 27001 across Indian regulatorsOne table of who asks for what, and how the ISMS answers.
Know your gaps before the auditor does.
Send the basics
Your locations, roughly how many people, the systems and cloud you run, and any frameworks you already follow.
We scope the work
We respond within 24 hours, then agree the scope with you in writing.
Your ISO 27001 gap analysis
You get a gap analysis report and a remediation roadmap, ranked by risk.
- First certification:
- a gap analysis and a roadmap to the Stage 2 audit.
- Already certified:
- internal audits, SoA updates and surveillance readiness.
We prepare you for certification. The audit and the certificate come from an independent, accredited certification body that you choose.