ISO 27001 Readiness and Implementation Support

Do you actually need it?

This is the first question we ask, and the answer is often no. ISO 27001 is a significant undertaking — typically six to twelve months for a first certification, with real ongoing cost in audits, internal audit time and management review. It is worth it when a customer contract requires it, when you sell into enterprise or public sector procurement that demands it, or when you handle client data at a scale that makes formal governance genuinely necessary.

It is not worth it as a general signal of seriousness when Cyber Essentials plus a documented risk assessment would satisfy everyone actually asking. We would rather tell you that and do the smaller piece of work well.

What the standard actually requires

ISO 27001 certifies a management system, not a technology stack. The clauses require you to define scope and context, secure leadership commitment, run a repeatable risk assessment, select controls to treat those risks, measure whether they work, audit yourself, review at management level, and improve. The Annex A controls — 93 of them in the 2022 revision, grouped into organisational, people, physical and technological themes — are the menu you select from, justified in a Statement of Applicability.

That structure is why the standard is respected: it forces a business to decide what it is protecting and why, rather than buying products. It is also why certification bodies fail organisations that have excellent technology and no evidence that anyone reviews it.

• ✓Scope, context and interested parties defined
• ✓Documented, repeatable risk assessment and treatment methodology
• ✓Statement of Applicability justifying every included and excluded control
• ✓Measurable objectives with evidence they are monitored
• ✓Internal audit programme and documented management review
• ✓Corrective action and continual improvement records

Proportionate to your size

The standard does not require a large organisation's paperwork from a small one. It requires a management system appropriate to your context, and auditors accept that a fifteen-person company operates differently from a bank. The failure mode we see most often is a consultant delivering a template pack built for a large enterprise, which the client cannot possibly maintain and which collapses at the first surveillance audit.

We build documentation you will actually keep up to date, sized to the business, with the review cadence set at something realistic. A system that is honestly maintained will pass; an impressive one that nobody has opened since certification will not.