Architects of Digital Trust.
Request a consultationქარ

INFORMATION SECURITY MANAGEMENT

ISO/IEC 27001:2022 Implementation & Certification Readiness

Build an Information Security Management System. Prepare for Independent Certification.

IO Consulting helps organisations design, implement and operate an Information Security Management System (ISMS) aligned with the requirements of ISO/IEC 27001:2022.

Our services cover gap assessment, information security risk management, policies and procedures, support for technical and organisational controls, internal audit and preparation for certification audits. The work is tailored to the organisation's agreed scope, existing capabilities and priorities.

Our aim is a working management system that helps protect the organisation's information, reduces risk and strengthens customer and partner confidence, while providing a sound basis for independent certification when sought.

Request an ISO 27001 ConsultationExplore the Implementation Process

Your ISMS

  • Governance
  • Risk
  • Controls
  • Assurance
Governance, risk, controls and assurance connected through one management system.

UNDERSTANDING ISO/IEC 27001

An International Standard for Systematic Information Security Management

ISO/IEC 27001:2022 is the international standard specifying requirements for establishing, implementing, maintaining and continually improving an Information Security Management System.

The standard helps organisations preserve the confidentiality, integrity and availability of information through risk-based management and organisational, people, physical and technological controls. It connects security responsibilities and operational decisions to the organisation's context and objectives.

  • Information Protection

    Protect the confidentiality, integrity and availability of information assets through controls proportionate to the organisation's risks and obligations.

  • Risk-Based Management

    Assess threats, vulnerabilities and potential impacts, evaluate risks against agreed criteria and prioritise appropriate treatment.

  • Integrated Governance

    Integrate information security responsibilities, processes and controls into the organisation's activities and management decisions.

  • Compliance Management

    Manage applicable information security requirements systematically and maintain evidence of how relevant obligations and controls are addressed.

  • Continual Improvement

    Evaluate security performance, monitor the management system and use corrective actions to address causes and improve effectiveness.

  • Stakeholder Confidence

    Demonstrate a systematic approach to information security to customers, partners and other interested parties through accountable processes and reliable evidence.

IMPLEMENTATION & READINESS

Our Two Core Services

ISO 27001 Implementation

We develop an Information Security Management System tailored to the organisation's business processes, technology environment and risk profile, and support its integration into day-to-day operations.

The Engagement Can Include

  • Current-state assessment and gap analysis
  • ISMS scope and organisational context definition
  • Information asset and risk management processes
  • Information security policies and procedures
  • Statement of Applicability (SoA) preparation
  • Support for implementing necessary security controls
  • Employee awareness and training
  • Security objectives, KPIs and monitoring arrangements
  • Integration of the ISMS into operational processes
Plan Your ISMS Implementation

ISO 27001 Certification Readiness

We prepare the organisation for audits conducted by an independent certification body, helping its teams demonstrate how the ISMS meets the standard's requirements and operates within the agreed scope.

The Engagement Can Include

  • Certification readiness assessment
  • Review of required documentation and supporting evidence
  • ISMS internal audit with objectivity and impartiality safeguards
  • Corrective-action planning for identified nonconformities
  • Support for management review of the ISMS
  • Documentation preparation for the Stage 1 audit
  • Implementation and effectiveness evidence for the Stage 2 audit
  • Support for the organisation's response to certification audit findings
Discuss Certification Readiness

A STRUCTURED IMPLEMENTATION PATH

From Initial Assessment to Certification Readiness

The implementation plan connects business context, risk decisions, necessary controls and evidence of operation. Responsibilities and outputs are agreed at the start, with each stage building the organisation's ability to operate and improve its own ISMS.

Select an implementation stage

Current-State Assessment

Understand organisational context, interested parties and the current level of alignment through a focused gap analysis.

Key Activities

  • Review existing processes, documentation and security arrangements
  • Identify business context and relevant interested-party requirements
  • Record gaps, dependencies and implementation priorities

Stage Outcome

A documented baseline and prioritised implementation roadmap for the agreed scope.

  1. Current-State Assessment

    Understand organisational context, interested parties and the current level of alignment through a focused gap analysis.

    Key Activities

    • Review existing processes, documentation and security arrangements
    • Identify business context and relevant interested-party requirements
    • Record gaps, dependencies and implementation priorities

    Stage Outcome

    A documented baseline and prioritised implementation roadmap for the agreed scope.

  2. ISMS Planning

    Define the scope, governance, responsibilities, objectives and project plan for a management system suited to the organisation.

    Key Activities

    • Agree ISMS boundaries, interfaces and external dependencies
    • Assign responsibilities and establish security objectives
    • Plan resources, milestones and governance arrangements

    Stage Outcome

    An agreed scope, governance structure and implementation plan with accountable owners.

  3. Information Security Risk Assessment

    Establish the risk methodology and identify information assets, threats, vulnerabilities and impacts within the ISMS scope.

    Key Activities

    • Define risk assessment and acceptance criteria
    • Identify risks to confidentiality, integrity and availability
    • Analyse and evaluate risks with the responsible owners

    Stage Outcome

    A repeatable risk assessment method and an information security risk register.

  4. Risk Treatment & Applicability

    Determine risk treatment options, necessary controls and the Statement of Applicability, supported by a risk treatment plan.

    Key Activities

    • Select treatment options and determine necessary controls
    • Compare controls with Annex A and justify inclusion or exclusion
    • Agree treatment responsibilities and residual-risk decisions

    Stage Outcome

    A risk treatment plan and SoA recording necessary controls, justifications and implementation status.

  5. Documentation & Control Implementation

    Develop policies, procedures and records, and support the agreed technical and organisational measures.

    Key Activities

    • Prepare policies and procedures aligned with operational practice
    • Support control owners with implementation and evidence requirements
    • Establish document control and relevant operating records

    Stage Outcome

    A usable documentation set and implementation evidence for the controls within the agreed scope.

  6. Training & Operational Integration

    Build employee awareness, clarify responsibilities and integrate controls into daily activities.

    Key Activities

    • Deliver awareness and role-specific training within the agreed scope
    • Integrate control activities and responsibilities into operations
    • Maintain training records and monitor security objectives

    Stage Outcome

    Informed teams, operating controls and records that demonstrate the ISMS in use.

  7. Internal Audit & Management Review

    Evaluate conformity and effectiveness through an objective internal audit and management review of the ISMS.

    Key Activities

    • Plan and conduct internal audit with competent, objective auditors
    • Document findings and review prior implementation involvement or conflicts
    • Support management review inputs, decisions and follow-up actions

    Stage Outcome

    Internal audit results and management review records, with clear decisions and improvement actions.

  8. Certification Readiness

    Address nonconformities and review preparation for the independent certification body's Stage 1 and Stage 2 audits.

    Key Activities

    • Review corrective actions and remaining readiness gaps
    • Organise documents and operating evidence for certification audits
    • Support responses to certification audit findings within the agreed scope

    Stage Outcome

    A documented readiness assessment and organised evidence for the independent certification process.

PRACTICAL PROJECT OUTPUTS

A Working Management System

An IO Consulting ISO 27001 engagement develops an Information Security Management System suited to the organisation's needs and agreed scope. The outputs help its teams manage risks, operate controls and maintain evidence for review and improvement.

  • ISMS Scope, Policy & Governance

    Documented boundaries, information security policy, objectives and responsibilities that establish how the management system is governed.

  • Risk Assessment & Treatment Plan

    An agreed assessment methodology, risk register and treatment plan with decisions, responsibilities and priorities.

  • Statement of Applicability

    A record of necessary controls, reasons for inclusion, implementation status and justified exclusions from the Annex A reference set.

  • Policies & Procedures

    A controlled documentation set aligned with the organisation's actual processes, risks and agreed implementation requirements.

  • Control Implementation & Effectiveness Evidence

    Relevant records and evidence references demonstrating how agreed controls have been implemented and evaluated in operation.

  • Training & Awareness Records

    Training materials, role-based guidance and participation or awareness records for the activities agreed in the engagement.

  • Internal Audit Programme, Plan & Report

    Where included, documented audit arrangements, scope, findings and conclusions prepared with objectivity and impartiality safeguards.

  • Management Review Outcomes

    Recorded management review inputs, decisions, responsibilities and follow-up actions supporting the suitability and effectiveness of the ISMS.

  • Corrective Action Plan

    A plan for addressing nonconformities and their causes, with responsible owners, agreed priorities and follow-up evidence.

  • Certification Audit Readiness Assessment

    A documented view of readiness, remaining gaps and the evidence available for the independent certification body's audits.

The final documentation and deliverables are defined by the organisation's size, activities, ISMS scope and agreed engagement terms. Management retains ownership of the ISMS, risk decisions and implementation responsibilities.

ANNEX A CONTROL REFERENCE

93 Controls. Four Security Themes.

Annex A of ISO/IEC 27001:2022 contains 93 information security controls grouped into four themes. This reference set supports risk treatment decisions; the organisation determines the controls necessary for its context, risks and applicable obligations.

Necessary controls are compared with Annex A to check that none have been overlooked. The Statement of Applicability records the necessary controls, why they are included, whether they are implemented and the justification for excluded Annex A controls. Additional controls can be selected or designed where required.

Explore an Annex A control category

Organisational Controls

Governance, policies, responsibilities and information security processes, including relevant supplier, incident, continuity and compliance arrangements. Applicability follows the organisation's risks and obligations.

  • 37

    Organisational Controls

    Governance, policies, responsibilities and information security processes, including relevant supplier, incident, continuity and compliance arrangements. Applicability follows the organisation's risks and obligations.

  • 8

    People Controls

    Security responsibilities and behaviours throughout the employment lifecycle, supported by appropriate awareness, training and arrangements for changes in roles or working conditions.

  • 14

    Physical Controls

    Protection of facilities, equipment and physical information assets against unauthorised access, environmental threats, loss or damage, proportionate to the organisation's operating environment.

  • 34

    Technological Controls

    Technology safeguards for systems, networks and information, including relevant access, configuration, monitoring, data protection and secure development measures selected through risk treatment.

The reference basis is ISO/IEC 27001:2022, including Amendment 1:2024 on climate action. The organisation determines whether climate change is relevant to its context and considers relevant interested-party requirements; this does not impose the same climate programme on every organisation. Applicability and exclusions concern Annex A controls, while the ISMS requirements in Clauses 4–10 remain applicable when claiming conformity.

ISO/IEC 27001:2022 — Official ISO Reference

INDEPENDENT CERTIFICATION

Two Audit Stages. An Independent Decision.

Readiness work prepares the organisation for a certification body's independent evaluation. Initial certification normally includes Stage 1 and Stage 2 audits, followed by review and the certification body's decision.

  1. Readiness Assessment

    Review the agreed ISMS scope, required documentation, internal audit, management review and available operating evidence. Identify gaps and organise corrective actions before the certification audits.

  2. Stage 1 — Documentation & Readiness

    The certification body reviews the ISMS scope, key documented information, the organisation's readiness and the conditions for proceeding to Stage 2. Its findings inform the planning and preparation for the next audit stage.

  3. Stage 2 — Implementation & Effectiveness

    The certification auditors evaluate whether the ISMS is implemented and effective, how relevant controls operate, whether supporting evidence is available and whether the standard's requirements are met within the certification scope.

  4. Certification Decision

    Following review of the audit outcomes and the handling of nonconformities, the certification body makes its decision. A certificate may be issued when its certification requirements have been satisfied.

IO Consulting supports implementation, readiness and responses to audit findings within the agreed scope. Certification audits, decisions and certificate issuance remain with the independent certification body. Neither readiness support nor completion of an implementation project guarantees certification or the absence of security incidents.

WHY IO CONSULTING

International Standards. Practical Security. Business Priorities.

Our approach is based on four principles that connect the management system to the organisation's work, risks and capacity for continual improvement.

  • An Organisation-Specific Approach

    We develop the ISMS around the organisation's activities, risks, technology environment and strategic priorities.

  • Practical Security

    We focus on operating security controls, clear responsibilities and evidence that reflects how information is protected in practice.

  • Support Across the Implementation Lifecycle

    We support the organisation from initial assessment through ISMS implementation, internal audit and certification readiness, with appropriate audit objectivity safeguards.

  • Sustainable Improvement

    We establish a basis for the organisation to maintain its information security management system and continue improving it after certification.

YOUR QUESTIONS

Frequently Asked Questions

How long does ISO 27001 implementation take?

The timeframe depends on the organisation's size, technology environment, existing security control maturity and project scope. An implementation plan is defined after the initial assessment, taking account of resources, dependencies and the evidence needed to demonstrate operation.

Is ISO 27001 certification mandatory?

ISO/IEC 27001 can be implemented without certification. Certification is an organisational choice unless a specific contract or other applicable obligation requires it. The implementation and certification objectives are confirmed when the engagement scope is agreed.

Can the ISMS cover one department or service?

The ISMS scope can be defined around specific organisational units, activities or services when the boundaries are justified and consistent with the standard. Relevant interfaces, dependencies and externally provided processes must be considered; a narrower scope does not remove requirements that apply to that ISMS.

Does implementation include an internal audit?

A full implementation engagement can include internal audit when this is part of the agreed scope. The audit must remain objective and impartial. Auditor competence, responsibilities, prior design or implementation work and conflicts are reviewed, with appropriate arrangements to avoid self-review; merely assigning a different team name is insufficient.

Does IO Consulting issue the certificate?

No. The certificate is issued by the relevant independent certification body following its audit and decision process. IO Consulting helps the organisation implement its ISMS and prepare for certification; it does not guarantee that a certificate will be issued.

PLAN YOUR NEXT STEP

Ready to Implement ISO 27001?

Build an Information Security Management System that helps protect your business and strengthens digital trust.

IO Consulting can help you assess your current information security arrangements, implement ISO/IEC 27001:2022 and prepare for independent certification. Start with a discussion of your organisation's needs, priorities and proposed scope.

Request an ISO 27001 ConsultationContact Us