ISO 27001 readiness
A customer asks for ISO 27001, which is a certification of an information-security management system, not a one-time scan of an application. We help you define the scope, close the gaps, write policies that match how you operate, and collect the evidence. An accredited certification body performs the audit and issues the certificate. We do not.
Typical engagement
How it starts
A written scope
The certificate
Issued by a certification body
What's included
6 capabilities
- Scoping of the information-security management system the customer named
- Gap assessment against the controls that apply to that scope
- Remediation in the application and the operating practices around it
- Policies and a risk treatment approach written for your company
- Evidence collection and an index an auditor can use
- Coordination through the certification audit
Every project ships with Gap report, Evidence index, A clear handover.
A management system, not a scan
ISO 27001 asks whether you have a way to decide what is in scope, which risks you accept, and whether the controls keep running. A vulnerability scan is not that system. We build the operating pieces your team can keep doing after we leave: who reviews access, how changes are approved, how incidents are recorded.
The certification body is independent of us. Our job is to make the scope honest and the evidence findable, then sit with your team through the audit.
What you walk away with
You get a scope that matches what the customer asked for, a gap report, policies written for how you operate, and an evidence index an auditor can use. The operating pieces are things your team can keep doing: access reviews, change approval, and a record of incidents. A scan of the network is not that system.
An accredited certification body performs the audit and issues the certificate. We do not. We stay on as the liaison through the audit. If the customer named SOC 2 and said ISO 27001, the written scope says which one, because they are not the same report.
Questions
Common questions
- Do you issue the ISO 27001 certificate?
- No. An accredited certification body audits the management system and issues the certificate. We prepare the scope, the controls, and the evidence, and we stay on through the audit.
- How is this different from SOC 2?
- SOC 2 is an attestation report issued by a licensed CPA firm about controls over a period or at a point in time. ISO 27001 is a certification of a management system by an accredited body. Customers sometimes say one and mean the other. The written scope names which one they asked for.
- Do we have to certify the whole company?
- Not always. The scope can be the system or the part of the business the customer cares about. A scope that is wider than the request wastes time. We write it down before the work starts.
- What do we get at handover?
- A gap report, policies written for how you operate, an evidence index, and a handover. The certificate, if the audit succeeds, comes from the certification body.
- Can this sit alongside SOC 2 work?
- Yes, when a customer has named both. A lot of the application work overlaps: access, logging, change management, backups. We will not pretend the two reports are the same thing.
Other services
Looking for something else? Each of these can stand alone, or combine with the work on this page.
- SOC 2 readinessWe prepare your application for a SOC 2 examination and stay on as the liaison. A licensed CPA firm issues the report.
- HIPAA readinessWe prepare the systems a small healthcare company needs ready for a HIPAA review: access, logging, backups, and the evidence to show it.
- PCI DSS readinessWe narrow where card data lives, close the gaps, and prepare the evidence. A qualified assessor issues any formal report.
- Compliance readinessSOC 2, HIPAA, PCI DSS, and other frameworks. We prepare your application and coordinate the examination.
A customer asking for ISO 27001?
Tell us the scope they named, and we will outline what the project covers.