ISO/IEC 27001:2022 Certification
Gap analysis, ISMS documentation, risk assessment and a maintained risk register, a proven proof of concept (POC) on a pilot scope, internal audit and hands-on support through certification, with the accredited certification body you choose.
Request a free gap assessment See the roadmap
What we do
One accountable team takes you from the first gap analysis to the certificate, and keeps your ISMS healthy afterwards.
A clause-by-clause and Annex A review of where you are today against ISO/IEC 27001:2022, with a prioritised, costed remediation plan.
We define the scope, interested parties, legal and contractual requirements and the information security objectives your ISMS must meet.
A repeatable risk methodology, asset and threat analysis, and a treatment plan that leadership can sign off.
Your living risk register set up from day one and kept current: new risks, treatments, owners and review dates, ready for every audit.
The complete, audit-ready document set written for your organisation, not templates with your logo on them.
Every Annex A control justified, mapped to its risks and implemented, with the evidence auditors expect to see.
We prove the ISMS on a pilot scope first, fix what does not work in practice, then roll it out across the organisation with confidence.
An independent internal audit and a structured management review, so your first certification audit holds no surprises.
We stand with you through the Stage 1 and Stage 2 audits with your chosen certification body, then support surveillance audits and recertification.
Zero to certified
Each phase ends with agreed deliverables, so you always know where you stand and what comes next.
Where you stand against ISO/IEC 27001:2022, and an agreed, costed roadmap to certification.
ISMS scope, objectives, risk methodology, risk assessment and the risk register.
Documentation set, Statement of Applicability and Annex A control implementation.
Run the ISMS on a pilot scope, prove the controls work, then roll out.
Independent internal audit, corrective actions and management review.
Stage 1 and Stage 2 audits with your chosen certification body, then surveillance support.
What you receive
Your certifier, your choice
Certificates are issued by accredited certification bodies. We stay independent of them, so you can choose the certifier you prefer, and we support you through their Stage 1 and Stage 2 audits.
Engagement options
Every engagement is quotation-based and scoped to your organisation, size and timeline.
Know exactly where you stand.
From zero to certified, end to end.
Everything in Gap Assessment, plus:
Stay certified, year after year.
Everything in Certification Programme, plus:
Not sure where to start? Begin with a free gap assessment call and we will recommend the right path and a tailored quotation within one business day.
Questions
It depends on your size, scope and starting point. Most organisations we work with are ready for the certification audit in roughly 3 to 9 months; the gap analysis gives you a realistic timeline for yours.
No. Certificates are issued only by accredited certification bodies. We prepare and support you so you pass, and you choose the accredited certification body you prefer; we work alongside any of them.
Yes. Our Certification Programme is built for organisations with no ISMS at all: we take you from the first gap analysis through documentation, risk management, controls and internal audit to the certification audits.
Yes. With the Managed ISMS service we keep your risk register current, run the periodic reviews and internal audits, and prepare you for every surveillance and recertification audit.
Documents written for your organisation, your scope and your risks, so they reflect how you actually work and stand up to auditor questions.
ISO/IEC 27001:2022 with its 93 Annex A controls. If you hold an ISO 27001:2013 certificate, we also run the transition to the 2022 version.
