ISO/IEC 27001 Readiness

Scoping, gap assessment, and ISMS build-out to prepare you for an ISO/IEC 27001:2022 certification audit.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Build an ISMS that passes certification and keeps working after it.

The challenge

A part­ner or cus­tomer wants ISO/IEC 27001 cer­ti­fi­ca­tion, and the stan­dard asks for more than a set of se­cu­ri­ty con­trols. It re­quires a man­age­ment sys­tem: a de­fined scope, a risk as­sess­ment, a Statement of Applicability, in­ter­nal au­dits, and man­age­ment re­views that ac­tu­al­ly hap­pen. Organizations that treat it as a doc­u­men­ta­tion ex­er­cise often strug­gle at the cer­ti­fi­ca­tion audit, or lose mo­men­tum soon after.

How we help

We start with scope: which parts of the or­ga­ni­za­tion, which lo­ca­tions, and which ser­vices the ISMS will cover. Then we run a gap as­sess­ment against the claus­es of ISO/IEC 27001:2022 and the Annex A con­trols, and agree a plan to close what's miss­ing.

We help you build what cer­ti­fi­ca­tion au­di­tors look for: the in­for­ma­tion se­cu­ri­ty risk as­sess­ment and treat­ment plan, the Statement of Applicability, poli­cies and pro­ce­dures, and the records that show the ISMS is work­ing. Before your cer­ti­fi­ca­tion audit, we help you plan your in­ter­nal audit and first man­age­ment re­view, so the sys­tem has been ex­er­cised be­fore the au­di­tors ar­rive.

Our prin­ci­pal ad­vi­sor is an ISO/IEC 27001 Lead Auditor, so the prepa­ra­tion re­flects how cer­ti­fi­ca­tion au­di­tors ap­proach the stan­dard.

What you get

  • ISMS scoping and context analysis
  • Gap assessment against ISO/IEC 27001:2022 clauses and Annex A controls
  • Information security risk assessment and treatment plan
  • Statement of Applicability
  • Policies, procedures, and ISMS records
  • Internal audit and management review planning before certification

Standards we work with: ISO/IEC 27001:2022, ISO/IEC 27002:2022, and ISO/IEC 27005.

Only an ac­cred­it­ed cer­ti­fi­ca­tion body can cer­ti­fy you to ISO/IEC 27001. We pre­pare you for cer­ti­fi­ca­tion. We don't cer­ti­fy.

Good fit if a cus­tomer or part­ner has asked for ISO/IEC 27001 cer­ti­fi­ca­tion, or you al­ready hold an­oth­er ISO cer­ti­fi­ca­tion and want to add in­for­ma­tion se­cu­ri­ty.

Questions clients ask

How long does it take to get ready?

It depends on your size, scope, and starting point. After the gap assessment, you'll get a timeline in writing.

Can you certify us?

No. Only an accredited certification body can certify you. We prepare you for the certification audit and help you plan your internal audit and management review beforehand.

More in Governance, Risk & Compliance

IT Risk Assessment

Identification and rating of the risks across your IT environment and critical business systems, measured against your risk appetite.

  • Risk identification across systems, processes, and IT operations
  • Likelihood and impact ratings tied to your risk appetite
  • A risk register with owners and treatment decisions
Learn more about IT Risk Assessment

Cybersecurity Risk Assessment

A threat-informed assessment of the cyber risks to your most important data and systems, rated in business terms.

  • Critical asset and data identification
  • Threat scenarios rated in business terms
  • A prioritized treatment plan for leadership
Explore about Cybersecurity Risk Assessment

Cloud Risk Assessment

An assessment of the risks in how you use the cloud, including provider dependence, data location, shared responsibility, and exit options.

  • Cloud service inventory and data classification
  • Provider, concentration, and exit risk
  • Shared responsibility gaps rated against your risk appetite
Learn more about Cloud Risk Assessment

GRC Program and Control Framework Design

One control library that links your risks, policies, controls, and obligations, so risk, compliance, and audit work from the same list.

  • An integrated risk and control library
  • A compliance obligations register linked to tested controls
  • Risk appetite statements and board reporting
Learn more about GRC Program and Control Framework Design

Information Security Policy Writing

Information security policies and standards, written or rewritten to fit how you operate and mapped to the frameworks your customers expect.

  • A policy and standard set sized to your organization
  • Mapping to NIST, ISO/IEC 27001, and SOC 2 criteria
  • An owner and review cycle for each document
Learn more about Information Security Policy Writing

Remediation Management

Issue and remediation tracking with owners, dates, and escalation, plus validation that each fix addresses the original risk.

  • Issue intake and prioritization
  • Owners, deadlines, and escalation paths
  • Closure validation before issues are closed
Learn more about Remediation Management

Third-Party Risk Management

A vendor risk program that tiers vendors by criticality and data access, so due diligence goes where the risk is.

  • Vendor tiering and due diligence
  • Third-party AI and fourth-party risk review
  • Event-driven reassessment and monitoring
Explore about Third-Party Risk Management

Vendor SOC Report Review

A close reading of your vendors' SOC reports: scope, exceptions, carved-out subservice organizations, and the user entity controls you must run.

  • Scope and coverage check against the services you use
  • Exception and carve-out analysis
  • Complementary user entity controls mapped to owners
Learn more about Vendor SOC Report Review

SOC 2 Readiness

Scoping, gap assessment, control design, and evidence preparation before your CPA firm begins the SOC 2 examination.

  • Type 1 or Type 2 scoping and criteria selection
  • Gap assessment and control design
  • Evidence planning and practice walkthroughs
Explore about SOC 2 Readiness

HIPAA and PCI DSS Readiness

Gap assessments and control design for the HIPAA Security Rule and PCI DSS v4.0, ahead of your assessor or regulator.

  • HIPAA Security Rule risk analysis support
  • PCI DSS v4.0 scoping and gap assessment
  • Control design and evidence preparation
Learn more about HIPAA and PCI DSS Readiness

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor