Governance, Risk & Compliance

ISO/IEC 27001 ISMS Implementation & Internal Audit

Build the management system, run the internal audit, pass the certification audit.

The situation

A certificate on the wall is worth little; a management system that actually governs risk is worth a great deal — and the certificate follows.

We implement ISO/IEC 27001:2022 as a working system: scoped honestly, risk-assessed properly, documented proportionately for the organisation, and internally audited by certified auditors before the certification body arrives. We also run the internal audit function on retainer for organisations already certified.

What the client receives

Schedule of deliverables

01Scope definition, context and interested-party analysis
02Risk assessment and Statement of Applicability across all 93 Annex A controls
03Proportionate policy set and mandatory documented information
04Control implementation support and evidence collection
05Internal audit programme and management review
06Certification audit support (Stage 1 and Stage 2)
07Surveillance-cycle retainer

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

ISO/IEC 27001:2022
ISO/IEC 27002:2022
ISO/IEC 27005
ISO 19011

Governance, Risk & ComplianceNIS2 Readiness & ImplementationFrom 'are we in scope?' to a registered, evidenced, defensible compliance position.Service detail Governance, Risk & ComplianceCyber Risk Management & AssessmentRisk assessment that produces decisions, not a spreadsheet nobody opens.Service detail

Discuss this engagement

Tell us about the scope you have in mind and the certification timetable and we will set out the scope, the method and the reporting format.