Skip to main content
VexaroSecurity
ISO 27001 readiness

ISO 27001 readiness & ISMS consulting

An ISO/IEC 27001 certificate is issued only by an accredited certification body after a formal audit. No consultancy can grant it. We help you build an Information Security Management System that is ready for that audit: scope and risk treatment, the Annex A controls, internal audit and management review, plus the penetration testing that evidences your technical controls. The certification audit is performed by an accredited body.

Scope

Building the ISMS

ISO/IEC 27001:2022 certifies a management system, not a single product. Clauses 4-10 of the standard define the ISMS, and Annex A lists 93 controls in four themes: Organizational, People, Physical and Technological. We help you set up the system and select, implement and evidence the controls that apply.

Typical scope
  • ISMS scope, context, leadership and the management-system requirements of clauses 4-10
  • Risk assessment and risk treatment plan, with the Statement of Applicability
  • Annex A 2022 controls (93 controls across the four themes) selection and implementation
  • Policies, procedures and records the auditor will sample
  • Penetration testing as evidence for the technological controls
  • Internal audit and management review ahead of the certification audit
How we work

We build it; an accredited body certifies it

We are your implementation and readiness partner. Certification is a Stage 1 (documentation) then Stage 2 (implementation) audit performed by an accredited certification body that must be independent of the people who built the ISMS. We prepare you and can run your internal audit, but we are not a certification body and never issue the certificate.

  1. 1

    Scoping & gap analysis

    We define the ISMS scope, run a gap analysis against ISO/IEC 27001:2022 and Annex A, and sign an NDA.

  2. 2

    Risk treatment

    We build the risk assessment, risk treatment plan and Statement of Applicability that drive control selection.

  3. 3

    Controls & documentation

    We implement the management-system clauses and Annex A controls, and run the pentest that evidences them.

  4. 4

    Internal audit & review

    We conduct the internal audit and management review so non-conformities are fixed before the external audit.

  5. 5

    Certification support

    We support you through the accredited body's Stage 1 and Stage 2 audits and any corrective actions.

Deliverables

What you receive

A complete, audit-ready ISMS and the technical evidence behind it. The certificate itself is issued by the accredited certification body after a successful Stage 2 audit, not by us.

What you get
  • Gap analysis against ISO/IEC 27001:2022 and the Annex A 2022 controls
  • Risk assessment, risk treatment plan and Statement of Applicability
  • ISMS policy and procedure set, plus the records the auditor samples
  • Penetration test report (CVSS 3.1, PoC, reproduction) evidencing technological controls
  • Internal audit report and management-review pack
  • Readiness sign-off and support through the certification audit
Methodology & standards

Grounded in ISO/IEC 27001:2022

ISO/IEC 27001:2022Annex A 2022 (93 controls)ISO/IEC 27002:2022Statement of ApplicabilityOWASP WSTGAccredited certification audit

Readiness follows ISO/IEC 27001:2022 (management-system clauses 4-10) with controls selected from Annex A 2022 (93 controls across the Organizational, People, Physical and Technological themes), guided by ISO/IEC 27002:2022. Only an accredited certification body grants the certificate, after a Stage 1 and Stage 2 audit. We provide the ISMS build-out, internal audit and the supporting penetration test, but we are not a certification body and do not issue ISO 27001 certificates.

Get ready for ISO 27001.

Tell us the ISMS scope you have in mind. We'll run the gap analysis, build the risk treatment and controls, evidence them with a pentest and prepare you for an accredited certification audit, under NDA. The first consultation is free.