Information security
ISO/IEC 27001:2022
Build an information security management system that fits how your business actually works.
Your engagement, step by step
From Understanding
To Readiness.
We tailor the sequence to your maturity, operating footprint and objectives. Each phase has clear responsibilities and tangible outputs.
Discuss this service- 01
Define The ISMS Boundary
Agree the business objectives, services, locations, interested parties and responsibilities covered by your information security management system.
Typical outputScope statement and engagement work plan
- 02
Assess Gaps And Risks
Review existing practices and evidence. Identify information security risks, evaluate treatment options and prioritize the work with your control owners.
Typical outputGap register, risk assessment and treatment plan
- 03
Build The Management System
Develop proportionate policies, governance routines and a Statement of Applicability. Connect selected controls to practical procedures and assigned owners.
Typical outputISMS documentation and control implementation roadmap
- 04
Operate And Collect Evidence
Support teams as they put controls into use, build awareness and maintain records. Track progress and resolve evidence gaps.
Typical outputEvidence register, ownership matrix and progress reviews
- 05
Review Readiness
Plan internal audit arrangements with safeguards for objectivity, support management review and track corrective actions. Prepare the team for an external certification assessment.
Typical outputReadiness summary and corrective action tracker
Getting started
What We Need From You
- Your business goals, target markets and readiness milestone
- A sponsor and access to relevant process or control owners
- Existing policies, system information and available evidence
- Known gaps, previous findings and external assessment plans
We agree the timeline after scoping. It depends on your starting point, systems, available people and the work needed to demonstrate operation.