ISMS implementation and internal audit
Certification is usually a client requirement before it is a security decision
Most organisations arrive at ISO 27001 because a customer, a tender or a group parent has asked for it, with a date attached. What follows is often a scramble: a consultancy sells a document set, the organisation signs it off without reading it, and the auditor finds an information security management system that exists on paper and nowhere else.
The standard is not the problem. Implementing it as a paperwork exercise is.
What we deliver
Gap assessment
A scored assessment of your current position against ISO/IEC 27001 requirements, identifying gaps, priorities and the work required to achieve certification readiness.
ISMS scope and Statement of Applicability
Defining what the ISMS covers and documenting which Annex A controls apply. Getting the scope right is one of the most important decisions affecting cost, timescale and audit complexity.
ISMS design and implementation
Developing the risk methodology, risk register, treatment plan, policies, security objectives, control requirements and records required by the standard. Technical control implementation is coordinated with your internal IT team or existing service provider.
Internal audit
An objective, evidence-based internal audit against ISO/IEC 27001 requirements, including documented findings and corrective actions. Internal audits are scoped separately from implementation activities to preserve auditor objectivity and impartiality.
Management review
Preparing the required management-review inputs, facilitating the review and documenting the decisions, actions and evidence that the certification auditor will expect to see.
Certification readiness and support
A readiness review before the Stage 1 audit, followed by evidence coordination and support through the Stage 1 and Stage 2 certification audits. Certification is issued independently by an accredited certification body.
How the engagement runs
Gap assessment first, sold as a standalone piece of work
Engagements begin with a gap assessment, which is deliberately sold as a standalone piece of work. It gives you a scored picture, a realistic timeline and a defensible budget before committing to a full implementation — and if the honest answer is that certification is not worth it for your organisation, you will hear that.
Implementation typically runs six to twelve months depending on scope and starting maturity. Internal audit and management review follow, then a readiness review before the certification body's Stage 1.
Where an organisation also has AI systems in scope, ISO 27001 and ISO 42001 are structured to share a management system. Running them together is materially cheaper than running them apart.
SACYBER assists in preparing organisations for certification. Certification is issued by an accredited certification body, which must be independent of the implementation.
