ISO Compliance Consulting Services

ISO 27001 is the international standard that specifies requirements for an Information Security Management System. It defines how to establish, implement, maintain, and continually improve an ISMS, including a formal risk assessment methodology, Annex A controls, and a Statement of Applicability. Organisations that handle sensitive client data, process payments, support government contracts, or sell into enterprise procurement typically find ISO 27001 is either a contractual requirement or a significant competitive advantage. Software companies, financial institutions, healthcare organisations, and outsourced service providers are among the most common certification candidates.

The Statement of Applicability is a mandatory document in ISO 27001. It lists all 93 controls from Annex A, declares whether each one is applicable to your ISMS, and provides a justified rationale for every inclusion and exclusion. For controls that are applicable, it records implementation status and cross-references the relevant policy or procedure. The certification body auditor reviews the Statement of Applicability during the stage 1 audit to confirm that your control selection follows logically from the risk assessment and risk treatment plan. A poorly constructed SoA is one of the most common reasons for major nonconformities at stage 1.

Stage 1 is a documentation readiness review. The certification body auditor examines your scope, policies, risk assessment, Statement of Applicability, and internal audit records to confirm the management system is sufficiently developed to proceed. Stage 2 is the main conformity assessment, an on-site visit where the auditor verifies that the system documented in stage 1 is genuinely implemented and operating effectively in practice. Both stages must be completed without outstanding major nonconformities before the certificate is issued. After certification, annual surveillance audits check for continued conformity and the three-year recertification audit renews the certificate.

Yes. All four standards use the Annex SL high-level structure, which means their clauses for context, leadership, planning, support, operation, performance evaluation, and improvement share the same architecture. An integrated management system merges these common clauses into one set of policies, objectives, internal audits, and management reviews, while each standard's unique requirements sit in their own sections. The integration reduces documentation by removing duplication and can lower combined audit costs because the certification body auditor covers multiple standards in fewer visits. We design and implement integrated systems for any combination of these four standards.

For a small to medium organisation building an ISMS from a low baseline, a realistic range is five to nine months from the gap analysis to receiving the certificate. Mid-size organisations with established security practices already in place often complete in three to five months. Large enterprises or those with complex multi-site scopes may require twelve months or longer. The gap analysis at the outset produces a milestone-based plan calibrated to your specific baseline rather than a generic estimate. ISO 9001 timelines are often shorter because many organisations already document their core processes.