ISO 27001 certification and implementation

Information security calls for coherence rather than isolated measures

Many organisations have already arranged all sorts of things: technical measures, procedures and awareness training. Yet the coherence is often missing. There is no single overview of risks, responsibilities are fragmented and controls do not work structurally. That makes it complicated to say to your management, clients and auditors: “we are in control”.

Meanwhile the pressure is growing. Clients set stricter requirements, ask for evidence in the form of audits and certificates, and include security clauses in contracts. Regulators expect more than an IT policy: they want a demonstrably working management system. Without a clear framework, ISO 27001 quickly becomes an extra project “on the side”, instead of a structured way to make information security part of how you steer your organisation.

What we do for you: from standard text to a certifiable ISMS

ISO 27001 describes what is expected of you, but not how you give that concrete shape in your organisation. That is exactly where we make the difference. Together with you we design a suitable ISMS. We help you identify risks, choose appropriate measures and record those measures in policy, processes and controls.

We do not limit ourselves to advice in broad outline. We actively help write the ISMS policy. Think of a scope statement, a risk assessment methodology, a Statement of Applicability and procedures. We help set up risk registers, asset inventories and the core processes of the ISMS. The result is a complete, certifiable ISMS: not only in theory, but with documentation that is ready for the eye of an external auditor.

The actual certification is carried out by an independent certification body, but you enter that process with a complete, tested and documented ISMS.