ISO/IEC 27001
A practical, scoped engagement for organisations seeking ISO/IEC 27001 support.
How we work
The ISO/IEC 27001 engagement follows the activities below. The scope and outputs are agreed with you before work starts.
- 01Define scope and security responsibilities.
- 02Assess information risks and control gaps.
- 03Agree treatments and document control applicability.
- 04Implement controls and gather operating evidence.
- 05Review internally and support independent assessment.
What you can expect
- ISMS scope and responsibility map
- Information security risk assessment, treatment plan and Statement of Applicability
- Control documentation, evidence register and audit findings tracker
What we need to get started
- Your services, locations and systems to include
- Existing security policies, asset inventories and risk assessments
- A management sponsor and owners for security and IT
From first discussion to delivery
Typical activities for this service. The agreed scope determines the work and outputs.
- 01Define scope and security responsibilities
- 02Assess information risks and control gaps
- 03Agree treatments and document control applicability
- 04Implement controls and gather operating evidence
- 05Review internally and support independent assessment
ISO/IEC 27001:2022: scope and objectives
Establish a risk-based system for managing information security across the people, processes, technology and suppliers in scope.
The standard applies to the management system and its defined scope. Certification does not mean every information asset or product is automatically risk-free.
Proposed scope of services
We agree the scope, delivery responsibilities and outputs for each engagement. The activities below describe a practical path and are tailored to your organisation.
| Engagement phase | Activities |
|---|---|
| Scope and context | Identify business activities, locations, interfaces, interested parties and information assets; define and approve the ISMS scope. |
| Leadership and governance | Assign accountable owners, define the information security policy and measurable objectives, and agree management oversight. |
| Risk assessment | Agree risk criteria and assess threats, vulnerabilities, consequences and existing safeguards for information and processes in scope. |
| Risk treatment and control selection | Prepare a risk treatment plan, identify appropriate controls and document their applicability, including a Statement of Applicability and reasons for exclusions. |
| Control implementation | Support proportionate controls for identity and access, assets, suppliers, operations, incident response, continuity and other risks identified in scope. |
| Documentation and evidence | Organise policies, procedures, risk decisions, owner records and evidence of controls operating in practice. |
| Awareness and operation | Brief responsible teams on their roles; run the agreed processes and address exceptions as they arise. |
| Internal audit and management review | Plan an impartial internal audit, assess evidence, record findings and support a management review of performance, risks and improvements. |
| Certification support | Coordinate readiness, assessment logistics, auditor questions and finding closure with the selected independent certification body. |
| Continual improvement | Track corrective actions and help prepare the organisation for ongoing surveillance and subsequent recertification. |
Readiness and certification path
We work with your team to establish the management system, operate the agreed processes, review evidence and address internal findings. The selected independent certification body determines its own audit scope and conducts the assessment. Initial certification commonly includes a Stage 1 readiness and planning review followed by a Stage 2 assessment of implementation and effectiveness. We can support coordination, responses and corrective actions; the independent body makes the certification decision.
Typical deliverables
- ISMS scope, governance and responsibility record
- Risk assessment, treatment plan and Statement of Applicability
- Applicable policies, control procedures and evidence register
- Internal audit findings, management review inputs and corrective action tracker
- Assessment coordination and finding-closure support
Our engagement approach
- Scope-led: tailor the management system to the organisation’s activities, boundaries and objectives.
- Evidence-driven: connect documented processes to responsible owners and evidence of operation.
- Practical implementation: prioritise gaps and improvements with agreed owners and timeframes.
- Independent assessment: support the audit process while preserving the certification body’s independent role.
- Continual improvement: hand over actions and review arrangements so the management system can continue to operate.
Reference: ISO guidance for ISO/IEC 27001:2022. The applicable edition, scope, assessment arrangements and deliverables are confirmed for each engagement.
Where an independent certification or attestation applies, the relevant independent body makes its own assessment and decision. Scope and availability are agreed individually.