A scope that fits
Define the activities, boundaries, interfaces and dependencies included in your ISMS.
Information security management
Build confidence.
Make ISO 27001
work for your business.
Connect information security to the way your organisation operates. Build a risk-based management system, put controls into practice and prepare for independent certification.
A practical engagement
More than policies.
A management system
people can use.
A certificate is one outcome. The work is about understanding information risks, assigning responsibility and showing that the system operates effectively.
Start with your business services, locations, people, technology and interested parties. Determine the controls you need from the risks you actually face, and keep decisions traceable.
Make the programme easier for your team to operate: turn agreed responsibilities into clear instructions, build checks into everyday work and keep evidence organised for the people who need it. Use practical review points to show what is working and what needs attention.
Read the ISO 27001 implementation and certification guide ↗
Explore ISMS scope, risk treatment, control ownership and the evidence needed for independent certification.
What you receive
Clear work.
Useful outputs.
Agree what success means, who owns each action and what evidence is needed before the work starts.
Risk decisions you can explain
Assess risks, plan treatment and maintain a reasoned Statement of Applicability.
Controls in daily use
Develop documentation, responsibilities, awareness and evidence of operation.
Evidence of effectiveness
Review performance, conduct internal audits, resolve findings and prepare for management review.
Your proposal should specify the scope, deliverables, responsibilities, assumptions, implementation effort and certification-body fees separately. The timeline depends on your starting point, complexity and evidence of operation.
Your pathway
Know what
happens next.
Scope, responsibilities and checkpoints are agreed around your business needs.
Plan the engagement ↗01
Discover & assess
Agree scope, understand current practices and prioritise the gaps.
02
Implement & enable
Support the risk assessment, control implementation, documentation and team awareness.
03
Review & prepare
Complete internal review, corrective action and readiness checks before the independent audit.
Relevant work to explore
A BPO preparing for customer assurance.
See the existing SOC 2 case as an example of related customer-assurance work. ISO 27001 and SOC 2 have distinct assurance outcomes.
Read the published case ↗Expertise that fits your business.
- Project leadership and agreed availability
- Relevant expertise and credentials to review
- Scope-specific deliverables and responsibilities
- Clear distinction between consulting and independent assurance
Questions worth asking
Make an
informed choice.
How long does ISO 27001 implementation take?
A useful estimate follows a scoping conversation and gap assessment. Organisation size, system complexity, existing controls and the time needed to demonstrate operation all affect the schedule. Avoid relying on a fixed-duration promise without those details.
Is every Annex A control mandatory?
Control selection is risk-based. Relevant controls are determined through risk treatment, and the Statement of Applicability records necessary controls, inclusion justifications, implementation status and reasons for excluding Annex A controls.
Can the programme support SOC 2 as well?
Where business needs justify both, map shared controls and evidence to reduce duplicated work. Preserve the differences in scope, assessment criteria and assurance outputs: an ISO certificate and an independent CPA SOC 2 report are not interchangeable.
Let’s define the right scope.
Share the requirement, your current position and the outcome you need.