Compliance Assessment
ISO/IEC 27001 Certification Services
We help you build and document an information security management system (ISMS) that meets ISO/IEC 27001 and is ready for a certification audit.
- Area
- Compliance Services
- Covers
- ISO 27001, ISMS
How we run an ISO/IEC 27001 project
ISO/IEC 27001 requires an information security management system (ISMS): a defined scope, a risk assessment, controls chosen to treat those risks, and the evidence that they operate.
What you get
What the engagement leaves you with.
An ISMS built around your existing processes instead of a parallel paper system
A risk assessment and Statement of Applicability specific to your organization
Integration with ISO 9001, ISO 22301 or ISO 20000 where you already use them
Guidance from ISO/IEC 27001 lead implementers and auditors
Frequently asked questions
Why should my organization pursue ISO/IEC 27001 certification?
Certification shows clients, partners and other stakeholders that an independent auditor has checked your information security management. It also helps reduce the risk of data breaches, supports legal and contractual requirements, improves business continuity and is often a condition in enterprise tenders.
What's the difference between ISO/IEC 27001 and ISO/IEC 27002?
ISO/IEC 27001 specifies the requirements for establishing and maintaining an ISMS, while ISO/IEC 27002 provides implementation guidance for the security controls referenced in Annex A of ISO/IEC 27001. Simply put, 27001 tells you what you need to do, while 27002 provides guidance on how to do it.
Do we need to implement all controls listed in Annex A?
No. ISO/IEC 27001 requires you to consider all Annex A controls but implement only those that are applicable to your identified risks. The Statement of Applicability (SoA) document explains which controls you've implemented and provides justification for any excluded controls.
Can ISO/IEC 27001 be integrated with other management standards?
Yes. ISO/IEC 27001 shares its structure with other ISO management standards such as ISO 9001 (Quality), ISO 22301 (Business Continuity) and ISO 20000 (IT Service Management). This makes it possible to run several management systems together with less duplicated effort.
Case Studies
- PDF
Fintech Cybersecurity Transformation and ISO 27001
A European fintech moved to a proactive security posture through penetration testing, new security architecture, ISO 27001 audit support and training.
Read the case study - PDF
Regional Bank Digital Transformation and Hybrid Cloud
A regional financial services firm modernized legacy applications on a secure hybrid cloud, with defense-in-depth security and ISO 27001 readiness.
Read the case study
Related services
Plan your ISO/IEC 27001 certification
Tell us about your scope and timeline, and we will explain what the project would involve.