ISO 27001 readiness & implementation

Agreeing which parts of the organisation, locations, systems and services the ISMS will cover, and recording the boundaries clearly.

Reviewing current practice against the clauses of the standard and the Annex A controls to establish where work is needed.

Establishing a risk methodology, identifying information security risks and deciding how each will be treated.

Recording which Annex A controls apply, why, and how they are implemented, with justified exclusions.

Developing the policies, procedures and technical and organisational controls the risk assessment calls for, sized to the organisation.

Evidence. Establishing records that show controls are operating, so an auditor can test practice rather than documents alone. Awareness. Helping staff understand their responsibilities under the ISMS through proportionate awareness activity. Internal audit. Planning and conducting an internal audit so that nonconformities are identified and addressed before the certification audit. Management review and corrective action. Supporting leadership through management review, and establishing a corrective action process that the auditor will expect to see used. Certification body preparation. Helping you select and engage an accredited certification body, preparing for Stage 1 and Stage 2, and supporting any findings through to closure.

It depends on the scope, your existing controls, how quickly evidence of operation can be built up and the certification body's availability. We set out a realistic plan once we understand your starting position, rather than quoting a standard timescale.

No. Certificates are issued by independent certification bodies, which should be accredited by a recognised accreditation body such as UKAS in the United Kingdom. We prepare you for their audit and support you through it.

They meet different needs. Cyber Essentials is a UK scheme covering a defined set of technical controls. ISO 27001 is an international management system standard covering governance, risk and a much broader set of controls. The right answer depends on what your customers or contracts require.