Cybersecurity Consulting
ISO/IEC 27001:2022 ISMS Implementation
We build your information security management system with you, from scope definition to the first internal audit. You enter the certification audit with a system that actually works.
What it is
ISO/IEC 27001:2022 sets requirements for establishing, operating and improving an information security management system (ISMS). An organization claiming conformity cannot exclude any of the standard's management system requirements. Which of the 93 controls in Annex A apply is determined by risk assessment. These decisions and their justifications are recorded in the Statement of Applicability (SoA).
Scope
- Defining ISMS scope, boundaries and interested parties
- Risk assessment method, risk register and risk treatment plan
- Selection of Annex A controls and Statement of Applicability
- Required policies, procedures and records
- Technical tests demonstrating critical controls function
- Internal audit program and management review
The need
When organizations need it
- When a customer or tender requires ISO/IEC 27001:2022 certification as a prerequisite.
- When you must prepare responses to each enterprise customer's security questionnaire from scratch.
- When written policies are not followed in practice and recurring audit findings persist.
Method
How we work
-
Scope
We define the processes, locations and systems to be certified with you. The scope is set according to your customer's or the tender's requirements.
-
Risks and controls
We assess risks based on assets and threats. We select controls and prepare the Statement of Applicability.
-
Implementation
We implement missing controls with your teams. We demonstrate through technical tests that critical controls function.
-
Internal audit
We plan the first internal audit with an auditor uninvolved in the implementation. Findings are addressed before the certification audit.
Outcome
What you have at the end
You have a functioning ISMS ready for the certification audit. Your risk register and Statement of Applicability reflect the actual state of your systems.
Frequently asked questions
Do you issue the certificate?
No. An independent certification body issues the certificate after conducting Stage 1 and Stage 2 audits. We build the system and prepare you for this audit.
Do we have to implement every Annex A control?
No. Controls are selected based on the risk assessment. The justification for omitting any control is documented in the Statement of Applicability.
When should we apply to a certification body?
In the Stage 1 audit, the certification body checks whether the internal audit and management review have been completed. Therefore, we plan the application after these two steps are finished.
Cybersecurity Consulting
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting