Our gap assessment evaluates your organization against all ISO 27001:2022 requirements — both the management system clauses (4-10) and the Annex A controls. We assess your existing policies, risk management processes, security controls, documentation, training, and governance structures. Every gap is documented with specific remediation recommendations, estimated effort, and prioritization based on certification impact and security risk.

The assessment also evaluates your organization's readiness for the certification process itself — management commitment, resource availability, scope definition, and timeline expectations. We set realistic expectations for the effort required and develop a project plan that leads to successful certification within your target timeline.

Deliverables include a gap assessment report, draft scope definition, preliminary Statement of Applicability, risk assessment methodology recommendation, certification timeline, and resource requirements estimate.

We design your ISMS framework including scope definition, information security policy, risk assessment and treatment methodology, Statement of Applicability, and the full documentation hierarchy from strategic policies through operational procedures. ISO 27001 requires documented information for context of the organization, leadership commitment, risk assessment and treatment, security objectives, competency evidence, operational planning, performance evaluation, and continual improvement.

Our documentation is tailored to your organization — not generic templates that auditors immediately recognize as boilerplate. Policies reflect your actual governance structure, procedures describe your actual operations, and the Statement of Applicability justifies control selection based on your actual risk assessment results. This approach ensures documentation survives auditor scrutiny because it accurately describes how your organization operates.

For organizations seeking integrated management systems, we design ISMS documentation that also addresses ISO 27701 (privacy), ISO 22301 (business continuity), or other standards relevant to your business.

We implement the Annex A controls identified in your Statement of Applicability. Technical controls include access management systems, encryption deployment, secure development practices, vulnerability management, network security, endpoint protection, logging and monitoring, and backup and recovery. Organizational controls include information security policies, role definitions, supplier management, incident management, business continuity, and compliance management. People controls include screening, training, and awareness programs. Physical controls include perimeter security, environmental monitoring, and equipment security.

Each control is implemented with the evidence collection approach that auditors expect — documented policies and procedures, training records, system configurations, monitoring logs, test results, and management review minutes. Our managed cybersecurity services can provide ongoing operation of technical controls including SIEM, EDR, vulnerability scanning, and 24/7 monitoring.

New in ISO 27001:2022 are controls for threat intelligence, cloud security, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, web filtering, and secure coding. We ensure these new controls are properly addressed.

Risk assessment is the foundation of ISO 27001. The standard requires a systematic, repeatable risk assessment methodology that identifies information security risks, analyzes their likelihood and impact, evaluates them against your risk criteria, and produces risk treatment decisions. We establish your risk assessment methodology, conduct the initial comprehensive risk assessment, develop the risk treatment plan, and connect risk treatment decisions to Annex A control selection documented in the Statement of Applicability.

Our risk assessment process considers threats, vulnerabilities, and impacts across all information assets within your ISMS scope. Risk treatment options include applying controls, accepting risk, avoiding risk, or transferring risk through insurance. Every decision is documented with justification, creating the risk-based audit trail that ISO 27001 demands.

We also establish the ongoing risk management process — including risk monitoring, periodic reassessment, and integration with change management — so your risk register remains current and your ISMS adapts to new threats and business changes.

ISO 27001 requires internal audits and management reviews before the certification audit. Internal audits evaluate whether the ISMS conforms to the standard's requirements and your own documented procedures. Management reviews ensure top management evaluates the ISMS's suitability, adequacy, and effectiveness. Both must be documented and produce actionable outputs.

We conduct internal audits using experienced auditors who understand what certification auditors look for. Our internal audit reports identify nonconformities using the same classification system certification bodies use, giving you a realistic preview of your certification readiness. Findings are documented with specific corrective actions and timelines so gaps are closed before the external auditor arrives.

We facilitate management reviews by preparing the required inputs (audit results, incident reports, risk assessment changes, performance metrics, improvement suggestions) and ensuring management outputs include clear decisions and action items that demonstrate the leadership engagement auditors expect to see.

We prepare your organization for both Stage 1 (documentation review) and Stage 2 (full assessment) certification audits. Preparation includes a mock audit that simulates the certification audit process, evidence package assembly ensuring all required documentation is readily accessible, staff interview preparation so team members can articulate how controls work and why they matter, nonconformity closure verification ensuring all internal audit findings are resolved, and logistics coordination with your chosen certification body.

During the certification audit, our team is available to provide support — answering auditor questions about ISMS design decisions, locating evidence, and addressing any findings that arise. After certification, we help you develop corrective action plans for any minor nonconformities identified and prepare your ongoing internal audit program for surveillance audits.

We also advise on certification body selection, helping you choose an accredited body that is appropriate for your industry and recognized by your customers and business partners.