ISO/IEC 27001:2022 readiness
Build a proportionate information security management system, operate it and prepare credible evidence for an independent certification audit.
From£7,999Starting scope for a small organisation with committed leadership and a clearly bounded ISMS.
From intent to an operating ISMS
- Organisation, interested parties and scope Clauses 4–5
- Risk method, assessment and treatment Clause 6
- Resources, competence and documents Clause 7
- Operational controls and evidence Clause 8
- Measurement, internal audit and review Clause 9
- Corrective action and improvement Clause 10
What the engagement builds
The objective is a working management system that reflects the organisation—not a folder of template policies disconnected from real operations.
- ISMS scope and context record
- Risk assessment method and risk register
- Risk treatment plan and Statement of Applicability
- Proportionate policies, procedures and ownership
- Evidence register and operating cadence
- Internal audit and management review preparation
Supplier access has no recorded risk ownerGap · treatment decision required
Control owner, evidence and review date assignedOperating evidence recorded
Delivery phases
Establish and implement
- Leadership and scope workshop
- Gap and maturity assessment
- Risk assessment and control selection
- ISMS documents and control ownership
Operate and prepare
- Evidence collection and control operation
- Awareness and role briefings
- Internal audit support
- Management review and corrective actions
Starting-scope assumptions
- One legal entity Organisation
- One bounded product or operating scope ISMS boundary
- Small leadership and delivery team People
- Cloud-first technology estate Technology
- Named internal ISMS owner Accountability
- Timely access to evidence and stakeholders Delivery
Important boundary
Our role
- Readiness and gap assessment
- ISMS design and implementation support
- Evidence and audit preparation
- Independent internal-audit support when compatible with impartiality
Not included
- ISO or UKAS endorsement
- Issuing the ISO/IEC 27001 certificate
- Certification-body audit fees
- A guarantee of certification
Prepare for an independent decision
Certification is performed by an independent certification body. We help you build and evidence the ISMS it will assess. The final scope and timetable follow a readiness call.