Scope and customer-requirement record
Define the services, locations and dependencies included. Record procurement expectations and the wording that the proposed certification needs to support.
Customer assurance grounded in everyday work
ISO 27001 consulting for UK business services.
A tender or new customer contract may require ISO 27001, but the implementation has to work beyond the procurement response. CyberVantage360 helps UK organisations define a suitable scope, put controls into daily use and prepare for independent certification. Make responsibilities clear for employees and keep assurance statements connected to evidence.
Start with the operating decision
Clarify the requirement before selecting the scope.
Ask what the customer expects the certificate to cover: a legal entity, a hosted service, a delivery function or several locations. Compare that request with the business model and dependencies. A narrow scope may be appropriate, but it should not be presented as covering excluded activities.
ISO/IEC 27001:2022 is the current ISMS reference in ISO's published overview. The programme should connect the intended boundary with information risk decisions and controls that people can operate. A set of policies is useful only when responsibilities, resources and evidence support it.
Follow information through sales, service delivery, supplier access and closure. Include staff working away from the office and the handling of records outside the main application. These interfaces often matter more to the control design than the wording of a generic template.
United Kingdom context
Align security work with the actual processing risk.
The ICO's data-security guidance describes risk-appropriate technical and organisational measures for personal data. It also notes that guidance is under review following legal changes. Use current advice for the processing in scope and keep privacy conclusions distinct from the ISO certification decision.
For UK professional and technology services, review how confidential client information moves through collaboration tools, external advisers and support channels. The ISMS can bring ownership and evidence together, while legal and privacy specialists resolve questions about processing and contractual duties.
Translate the decisions into staff instructions. A person sending a client file should be able to identify the authorised route and know where to ask about an exception, without interpreting a lengthy risk register.
Agreed outputs
Create a programme the business can explain.
Agree deliverables around the service, customer expectation and implementation responsibilities.
Risk treatment and applicability decisions
Assess material information risks, choose treatments and maintain a Statement of Applicability that explains control decisions and implementation status.
Operating workflows and staff guidance
Develop practical access, information-handling, supplier and incident processes. Assign ownership and test the instructions with the people expected to follow them.
Readiness and improvement evidence
Plan internal audit, management review and corrective action. Keep evidence retrievable and identify unresolved work before committing to the external assessment.
Practical implementation
Use real work to challenge the proposed controls.
Select a recent service engagement and walk through onboarding, delivery, changes and closure. Ask staff to show how approvals and records are obtained. Where the real process differs from the documented one, decide whether the process or the document needs to change.
Build a schedule around implementation dependencies and evidence of operation. The proposal should state client effort, specialist inputs and certification-body costs separately. A procurement deadline is an important planning input; it does not remove the need to implement and demonstrate the agreed controls.
Illustrative operating decisions
Two UK customer-assurance situations.
Hypothetical examples, not client case studies or claims of completed engagements.
A professional-services firm introduces a client portal
A hypothetical UK advisory firm replaces email exchanges with a client portal. Staff assume that using the portal resolves all handling risks, but some clients still send documents by email and external advisers need occasional access.
The programme maps both normal and exception routes. It defines access approval, retention decisions and staff instructions for material received elsewhere. Internal review tests how an engagement closes and whether former participants retain access.
A software provider responds to an enterprise tender
A hypothetical UK software business receives a tender requiring ISO 27001 certification for the proposed service. Its existing controls cover corporate IT, while the hosted product depends on a cloud platform and outsourced support.
The scope discussion identifies the delivery components that the customer expects to see covered. Product, security and commercial owners agree an accurate assurance statement, implementation actions and evidence responsibilities before offering an assessment date.
Our service commitment
100% successful ISO certification guaranteed.
Our guarantee applies to the agreed ISO certification engagement. Confirm its scope and terms in your proposal. The independent certification body conducts the audit and makes the certification decision.
Agree the certification scope and assessment plan with the independent certification body. Verify that the intended certificate supports the actual customer statement and that unresolved findings have clear owners and closure evidence.
Before you commission the work
Make the procurement and implementation expectations clear.
Can we choose a narrow scope for one contract?
A defined service scope may be appropriate if its interfaces and dependencies are addressed. Ensure the customer understands what is included and excluded before relying on the certificate.
Does certification establish compliance with UK data-protection law?
No automatic legal conclusion follows. The ISMS can provide relevant security evidence, but processing duties and current legal requirements need their own assessment.
Will Cyber Essentials evidence cover the whole programme?
Existing security evidence can be reviewed for relevance. Do not assume a separate scheme's scope and controls satisfy every management-system requirement or risk decision.
Can policies be developed before technical changes are complete?
They can be prepared alongside implementation, but should describe the intended and actual arrangements accurately. Track unresolved work and avoid presenting planned controls as operating evidence.
How is staff disruption managed?
Use focused working sessions and existing records where suitable. Agree owners and implementation windows, while allowing enough time to test that the controls work in practice.
What should we share for an initial estimate?
Provide the customer requirement, service boundary, locations, main suppliers, existing controls and target date. Identify who can commit resources and make scope decisions.
Reference basis
Sources and scope of this guidance
ISO: ISO/IEC 27001:2022 overview; ICO: A guide to data security; ISO: independent certification.
Official references checked 13 October 2026. The implementation examples are practical recommendations; legal applicability and the agreed certification scope need their own review.
Plan the engagement
Start with the customer requirement and the real service.
Share the assurance request and the way the service is delivered. We can discuss a scope and implementation plan that your commercial and operating teams can both use.