Information security you can show an auditor
We implement ISO/IEC 27001:2022 and ISO 9001:2015 management systems, and run security monitoring that keeps them working after the certificate is issued.
ISO/IEC 27001:2022 implementation
An information security management system (ISMS) is how an organisation decides which risks matter, puts controls around them, and proves those controls work. ISO/IEC 27001 is the international standard for it.
We take you from a first gap assessment to a certification-ready ISMS: scoping, risk assessment, policies, control implementation, staff awareness, internal audit and management review. We write the documents with you, not for a shelf.
Certificates are issued by an independent, accredited certification body. Our role is to prepare your organisation, and support you through the Stage 1 and Stage 2 audits.
The 93 Annex A controls, in four themes
Every control is assessed for your organisation and recorded in a Statement of Applicability.
The path to certification
A typical ISO/IEC 27001 engagement for a small or mid-sized organisation. Timelines depend on scope and how much is already in place.
What you receive
- ISMS scope and context of the organisation
- Asset register, risk assessment and treatment plan
- Statement of Applicability
- Policies, procedures and records
- Training and awareness records
- Internal audit report and management review minutes
- Weeks 1–2
Gap assessment & scope
Where you stand against the standard, what the ISMS will cover, and a written plan.
- Weeks 3–6
Risk assessment & treatment
Asset register, risk methodology, risk treatment plan and Statement of Applicability.
- Weeks 6–12
Policies & controls
Policies and procedures written with your team; technical controls implemented and evidenced.
- Weeks 10–14
Awareness training
Short, role-specific sessions so staff know what is expected of them.
- Weeks 14–16
Internal audit & management review
An independent internal audit, corrective actions, and a recorded management review.
- Then
Certification audits
We support you through Stage 1 and Stage 2 audits with the certification body, and through surveillance audits after.
ISO 9001:2015 quality management
A quality management system that describes how your organisation actually works, and improves it.
We map your processes, set measurable quality objectives, write the procedures and records the standard needs, and train internal auditors. Many clients run ISO 9001 and ISO 27001 together as one integrated management system, which cuts out duplicated paperwork.
Plan
Context, risks and opportunities, quality policy and objectives.
Do
Documented processes, competent people and controlled records.
Check
Customer feedback, process metrics and internal audits.
Act
Management review, corrective action and continual improvement.
What we deliver
- Process mapping and quality manual
- Quality policy and measurable objectives
- Document and record control
- Customer feedback and complaints handling
- Internal auditor training
- Corrective action and continual improvement
- Integrated management system with ISO/IEC 27001
SOC monitoring & incident response
A security operations centre watches your systems for signs of attack and responds on a defined playbook. Ours is aligned with ISO/IEC 27001:2022 controls for logging, monitoring and incident management.
Collect
Logs from servers, firewalls, applications and cloud accounts, gathered centrally and retained for investigation.
Detect
Rules and alerts tuned to your environment, so the alerts that reach a person are worth reading.
Respond
Containment, investigation and a written incident report, with lessons fed back into your controls.
Vulnerability management
Regular scans of your web applications and servers, with fixes prioritised by real risk.
Incident response plan
Roles, contacts and steps written down before you need them, including CERT-In reporting obligations.
Monthly reporting
A plain-language summary for management, and the evidence your auditor will ask for.
CERT-In reporting: under CERT-In’s 2022 directions, specified cyber incidents must be reported within 6 hours of noticing them. Our response plans build this in, alongside DPDP Act breach notification.
Discuss SOC monitoringStart with a gap assessment
We review where you stand against ISO/IEC 27001 or ISO 9001 and give you a written, prioritised plan.