Compliance · ISO 27001
ISO 27001
The international standard for an Information Security Management System (ISMS), recognised by clients, insurers and regulators worldwide.
01
What it is
A risk-based management system, not a checklist.
ISO 27001 defines how to build and run an ISMS: a risk-based system of policies, controls and evidence, supported by the Annex A control set.
Certification is awarded by an accredited body following Stage 1 and Stage 2 audits, then maintained through surveillance audits.
02
Who needs it
When a recognised standard is the price of entry.
It is widely expected by enterprise clients, insurers and regulators, and frequently appears as a hard requirement in supplier audits and bids.
03
How we help
Scope it tight, build it to last, keep it alive.
- Scope the ISMS tightly so the work is proportionate
- Run a gap analysis against the standard and the Annex A controls
- Build the controls, documentation and evidence, and run the management system
- Certification audits delivered through certified assessment partners
- Maintain it continuously so surveillance audits never become a scramble
Thinking about ISO 27001?
We’ll help you scope it before you commit. Most quotes go wrong because the scope is wrong.
Book a call