ISO 27001 that runs your business, not the other way round.
ISO 27001 is the international standard for managing information security. Done badly, it's a binder nobody reads. Done properly, it's how your organisation actually works. I'm a certified ISO 27001 implementation practitioner, and I help you build the second kind.
How I help
- Scoping: agreeing what's in, what's out, and why.
- Risk assessment and treatment, written so the board can follow it.
- Policies and controls sized to your organisation, not copied from a template.
- Internal readiness checks before your certification body arrives.
- Ongoing support to keep the system alive between audits.
Already have Cyber Essentials?
Good news: a lot of that work carries straight across into your ISO 27001 controls. If you don't have it yet, Cyber Essentials is often the quickest place to start.
A note on certification. Certification is carried out by an independent, accredited certification body. My job is to get you there ready, with no nasty surprises on audit day.
ISO 27001 questions
How long does ISO 27001 take?
Usually several months from start to certification, depending on your size, scope and how much is already in place. I'll give you a realistic timeline once we've agreed the scope. See typical ISO 27001 costs and timelines.
Do we have to implement every Annex A control?
No. ISO 27001:2022 lists 93 controls in Annex A, and you choose the ones that address your risks. Your Statement of Applicability records which apply and why.
What happens at the certification audit?
There are two stages. Stage 1 reviews your documentation and readiness, and Stage 2 checks the system is working in practice. After that there are surveillance audits each year and a full recertification every three years.
Is ISO 27001 worth it for a small organisation?
If clients or tenders ask for it, or you handle sensitive data at scale, often yes. If not, Cyber Essentials may be the better first step. I'll tell you honestly which fits.
Let's talk scope and timeline.
Book a 30 minute call to talk through where you are and what certification would take.