ISO/IEC 27001
The security certification most requested in tenders and enterprise contracts. We implement an ISMS that works day to day, not a binder of policies.
Information security management system
- What is at stake
- Required in tenders and enterprise contracts
Who it applies to
- Companies selling to large accounts
- Technology and SaaS providers
- Anyone wanting a shared base for NIS2 and DORA
Typical timeline
4 to 6 months
Information security management system
In detail
A management system, not a binder.
ISO/IEC 27001:2022 defines how to run an Information Security Management System (ISMS): identify risks, decide how to treat them, apply controls and improve continuously. It is the most recognised security standard in the world and the one customers and tenders ask for most.
The 2022 version reorganised Annex A into 93 controls across four themes (organisational, people, physical and technological) and added new ones such as threat intelligence, cloud security, data leakage prevention and monitoring. The transition period from the 2013 version ended in October 2025.
The certificate is issued by an accredited body after a two-stage audit, is valid for three years and requires annual surveillance audits.
Real scenarios
Why our clients need it.
Customer questionnaires
An ISO 27001 certificate answers most of an enterprise security questionnaire in one go.
Private and public tenders
It is a qualifying or scoring criterion in many tenders and is partially recognised as equivalent to ENS.
Internal order
It forces you to know which assets you have, who accesses what and what to do when something fails. Many companies feel it in operations.
What you get
What you will have at the end.
- ISMS scope and organisational context
- Risk methodology and assessment
- Statement of Applicability (SoA)
- Required policies and procedures
- Security metrics and management review
- Internal audit and non-conformity management
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
ISO
What we focus on
- 01
Risk assessment and treatment
- 02
The 93 Annex A controls
- 03
Internal audit and management review
- 04
Documented continual improvement
ISO/IEC 27001
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for ISO/IEC 27001 cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Can only part of the company be certified?
Yes. Scope can be limited to a product, service or site if justified. Starting with what customers ask for is common.
What if the auditor finds issues?
They are logged as non-conformities. Minor ones are fixed via an action plan; major ones must be closed before the certificate is issued.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.