Fee
Register to see indicative feesConfirmed in writing after scoping01 / Readiness · Flagship
ISO 27001 Readiness
A customer has asked for your ISO 27001 certificate, and you do not have one.
Assurance & ComplianceCertification readiness
Typical duration
16 to 24 weeksDepends on scope, existing documentation and evidence maturityPrimary artefact
Audit-ready ISMS with an Annex A evidence packPlus four moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What ISO 27001 Readiness is
ISO/IEC 27001 is the international standard for information security management systems. This service prepares your organisation to be certified against it by an accredited certification body.
And what this service produces
It produces an operating ISMS (scope, risk method, policies, Annex A controls, internal audit and management review) and the evidence pack a stage-1 and stage-2 audit expects to find.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- Your customers or tenders require certification.
- You have committed to a certification date.
- You sell into enterprise or government.
- Your ISMS exists on paper but has never been audited.
02
The usual trigger
- A customer contract or tender requires the certificate.
- An enterprise deal is blocked on it.
- The board has set a certification target.
- A previous attempt stalled.
06 / The obligation
What the standard actually requires, and where readiness programmes stall
ISO 27001 is a management-system standard, not a control checklist. The controls in Annex A matter, but the clauses are what an auditor tests, and the clauses require a system that has been operating, not one that has been documented.
Most organisations do not struggle with the decision to certify. They struggle with scope definition, with interpreting requirements against an estate that changes, with building evidence an auditor will accept, and with the two clauses that cannot be shortcut.
Scope
Which parts of the organisation, which systems, which locations. The most consequential decision in the programme and the one most often revisited too late.
Risk and the Statement of Applicability
Risk assessment and treatment, and the Statement of Applicability. The SoA is the document an auditor reads first.
Operational planning and control
Evidence that the controls are actually operating.
Monitoring, internal audit and management review
The most common stage-2 finding, because it requires the system to have been running for a period.
Annex A controls
93 controls across organisational, people, physical and technological themes. Exclusions are permitted but must be justified in the SoA.
An auditor does not ask whether your policies are good. They ask whether the system decided something, did it, checked it, and recorded what it found.
07 / What you receive
Five artefacts. Each one yours to keep.
- 01
ISMS documentation set
Scope, policies, procedures and the Statement of Applicability, written for your organisation.
Document setISMS owner - 02
Annex A control gap register
All 93 controls, current state, gap, and what closes it, prioritised and effort-estimated.
RegisterSecurity and IT - 03
Risk assessment and treatment plan
A repeatable risk method, applied, with the treatment plan an auditor expects.
Method + registerRisk owner - 04
Internal audit programme and first audit
Schedule, checklists and one completed internal audit against the standard.
Audit reportManagement review - 05
Certification-body liaison
We prepare the submission, attend stage 1, and manage findings through to stage 2.
Named activityThrough certification
08 / Scope
The whole system is visible before work begins.
Scope and context
- ISMS scope defined and justified
- Interested parties and requirements
- Boundaries and exclusions
Risk
- Risk assessment method
- Risk register and treatment plan
- Statement of Applicability
Documentation
- Information security policy and supporting procedures
- Records and retention
- Document control
Annex A controls
- All 93 controls assessed
- Gap closure design
- Justified exclusions documented
Assurance
- Internal audit programme
- First internal audit
- Management review
Certification support
- Stage-1 readiness review
- Submission pack
- Stage-2 finding management
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- ISMS scope and organisational context
- Risk assessment, treatment and the Statement of Applicability
- ISMS documentation and document control
- Assessment of all 93 Annex A controls and gap closure design
- Internal audit and management review
- Stage-1 and stage-2 certification support
Not included
- The certificate: Certification is issued by an accredited certification body following their audit. We are not one.
- Certification-body fees: Billed directly by the certification body, not included here.
- Control implementation: Where a gap requires building something, we design and specify. Building it is your team or separate work.
- Ongoing ISMS operation: We hand over an operating system and a named owner. Running it is yours, or a separate retainer.
- Penetration testing: Where the SoA requires testing, that is scoped separately.
10 / How we do it
A traceable path from scope to evidence.
Scoping and gap assessment
Scope defined, then every clause and all 93 Annex A controls assessed against current reality.
Risk and SoA
Risk method built and applied; Statement of Applicability drafted with exclusions justified.
Documentation and control design
Policies, procedures and the control designs that close the register.
Implementation support
Your team operates the ISMS while we support and evidence. This phase cannot be compressed.
Internal audit and management review
First internal audit run, management review facilitated, findings closed.
Certification support
Stage-1 readiness, submission and stage-2 finding management.
Mapped againstISO/IEC 27001ISO/IEC 27002ISO/IEC 27005NIST Cybersecurity Framework
11 / Timeline
16 to 24 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 4
Scoping and gap assessment
Define the scope, then assess every clause and all 93 Annex A controls against current reality.
Customer effort
Two half-day workshops, plus system and documentation access.
Weeks 5 to 8
Risk method, register and SoA
Build and apply the risk method, and draft the Statement of Applicability with exclusions justified.
Customer effort
One workshop plus four to six interviews.
Weeks 9 to 14
Documentation and control design
Write the policies, procedures and control designs that close the register.
Customer effort
Review cycles, roughly five to eight hours a week from the ISMS owner.
Weeks 15 to 22
Implementation support, internal audit, management review
Your team operates the ISMS while we support and evidence, then the first internal audit and management review are run.
Customer effort
Your team operates the ISMS; one management review session.
External
Stage-1 audit
Scheduled by the certification body, typically two to four weeks after readiness.
Customer effort
Certification-body timing; not controlled by us.
External
Stage-2 audit
Typically four to eight weeks after stage 1. Our work runs 16 to 24 weeks; the full path to a certificate is usually 8 to 12 months, because an auditor must see the ISMS operating, not merely documented.
Customer effort
Certification-body timing; not controlled by us.
Our work: 16 to 24 weeks
12 / Scope check
Test whether ISO 27001 Readiness
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your ISO 27001 engagement lead
Steve Sharma
Founder & Principal
Runs the gap assessment, drafts the SoA, and attends both certification audits.
ISO/IEC 27001 Lead AuditorASD-endorsed IRAP AssessorCISSP
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
The clause map is published before you engage.
You can check whether we understand the standard before paying us anything.
We prepare, and we say who certifies.
The boundary is stated on the page, not discovered in the closing meeting.
The ISMS is built to be run by your team.
Every deliverable names the internal owner it hands to, with documented handover so the system does not depend on us.
15 / The boundary
What this engagement does not claim.
Certification
We prepare organisations. We do not certify our own work.
We prepare organisations for assessment and certification, but we do not certify our own work. Accredited certification bodies certify, and we never sit on both sides of that line.
Operations
We are not a managed security service.
We do not run your SOC or monitor your environment.
Engineering
We design and specify. Building is separate.
Where a gap requires building something, we design and specify it. Building it is your team or separate work.
Frameworks
One ISMS, mapped across four references.
The work maps to ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005 and the NIST Cybersecurity Framework.
What moves the fee
Per additional site or major system group inside the ISMS scope.
Where policies and records already exist.
Where records must be reconstructed to evidence the controls.
Fixed-fee phases from a stated starting pointStarting fee confirmed in writing after scopingCertification-body fees excluded and billed by them directly
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
01
No customer or tender is asking for the certificate.
The underlying security work delivers the value at a fraction of the cost.
02
You need certification in under four months.
Reset the date first; an auditor must see the ISMS operating.
03
Your real need is a specific control gap.
An assessment closes that faster and far more cheaply.
20 / FAQ
The questions that change the decision.
Our work runs 16 to 24 weeks; the full path is usually 8 to 12 months. The audit windows belong to the certification body and the ISMS must be seen operating. Anyone promising a certificate in three months is describing documentation, not certification.
No. Certification is issued by an accredited certification body following their own audit. We prepare, attend and manage findings, but we do not certify our own work.
Internal audit and management review, which is clause 9. Both require the system to have been running for a period, which is why the implementation phase cannot be compressed however much anyone would like it to be.
No. Exclusions are permitted and normal, but each must be justified in the Statement of Applicability. The SoA is usually the first document an auditor reads.
Usually not. If no customer, tender or regulator requires it, the underlying security work delivers almost all of the value without the audit overhead, and we would rather scope you into an assessment and say so.
Surveillance audits annually and recertification at three years. Keeping the ISMS alive between them is what Continuous Compliance covers, and it is a separate arrangement rather than an assumed extension.
21 / Next move
If ISO 27001 Readiness is what you need, the next step is a conversation about scope.
A 45-minute conversation about what your scope actually looks like, what it would cost, and whether this is the right service for you at all. With Steve Sharma, who would lead the engagement.