ISO 27001 implementation & audit readiness
From gap analysis to a certification audit you are ready for, with ISO 27701, ISO 9001 and ISO 14001 as extensions.
We guide you through building an information security management system (ISMS) that fits your organisation and is ready for the certification audit. Where possible we build on the Microsoft 365 tools you already use, instead of adding new systems.
When you are ready to go further, we extend the ISMS with privacy information management (ISO 27701) or integrate it with your quality (ISO 9001) and environmental (ISO 14001) management systems, so you run one management system instead of three.
What this service includes
Gap analysis
Where you stand against ISO 27001:2022 and Annex A, and what it takes to close the gaps.
Risk assessment and SoA
A practical risk method and a Statement of Applicability that explains every control decision.
Policies and procedures
Documentation sized for your organisation, written so people actually follow it.
Evidence from Microsoft 365
Entra ID, Intune, Defender and Purview configured and documented as evidence for Annex A controls.
Audit readiness
Internal audit, management review and support during the stage 1 and stage 2 certification audits.
Extensions
ISO 27701 for privacy, and integration with ISO 9001 and ISO 14001 into one management system.
How it works
- 1
Gap analysis
A clear picture of where you stand and a realistic estimate of the work ahead.
- 2
Scope and plan
We agree the ISMS scope, the timeline and who does what.
- 3
Build
Risk assessment, controls, policies and Microsoft 365 configuration, step by step.
- 4
Audit ready
Internal audit and management review, then support during the certification audit.
Common questions
How long does ISO 27001 implementation take?
That depends on your size, scope and starting point. The gap analysis gives you a realistic timeline before you commit to the rest of the project.
Do you issue the certificate?
No. Certification is done by an accredited certification body. We prepare you for that audit and support you during it, which keeps advice and audit independent.
What does integration with ISO 9001 and ISO 14001 mean?
These standards share the same high-level structure. We combine the shared parts, such as document control, internal audits, management review and improvement, so you maintain them once.
What is ISO 27701?
An extension of ISO 27001 for privacy information management. It helps you show how you handle personal data under the GDPR, and can be certified together with ISO 27001.
