Information security management
ISO/IEC 27001: information security management
Secure your data. Earn their trust.
ISO/IEC 27001 is the international standard for an information security management system (ISMS): a risk-based way to protect the confidentiality, integrity and availability of your information, and to show customers and partners that you manage it deliberately. Certification, issued by an independent accredited body, gives them evidence instead of a promise.
What the standard asks for
- A defined scope and an information security policy owned by management
- A repeatable information security risk assessment and a risk treatment plan
- A Statement of Applicability that records which controls apply and why
- Controls from Annex A (93 in the 2022 edition) across organisational, people, physical and technological areas
- Internal audit, management review and a route for continual improvement
When it usually comes up
Customer security questionnaires, tenders that ask for certification, or regulated and sensitive data in your care.
Good to know
- It often comes first because the risk, asset and audit processes it builds are reused when you add privacy, AI or energy management later.
- The standard sets requirements for a management system. It does not prescribe one set of tools, and it is not a legal opinion.
How we help with ISO/IEC 27001
- Gap analysis
- Know exactly where you stand before you commit.
- Documentation
- Policies and procedures built around how you actually work.
- Implementation support
- Hands-on guidance from roadmap to rollout.
- Risk assessment
- Identify and treat risks before they become findings.
- Internal audit
- Find the gaps before the external auditor does.
- Training
- Your team understands the system and keeps it alive.
- Certification support
- Preparation for the Stage 1 and Stage 2 audits run by your chosen certification body.
- Maintenance
- Support through surveillance audits and continual improvement.
We advise and prepare. Certification is issued by an accredited certification body that is independent of us.
Often built together with
The ISO management system standards share one structure, so what you build for ISO/IEC 27001 is reused when you add another.
Working towards ISO/IEC 27001?
A scoping call is a conversation about your organisation, the standards in play, and what a sensible first step looks like.