ISO 27001 Gap Assessment
A measured comparison of your current state against every Annex A control, producing a prioritised implementation backlog rather than a pass/fail verdict.
Governance, risk & compliance
ISO 27001 implementation, risk management frameworks and regulatory compliance — built by a company that holds the certification it implements for others.
Most compliance projects fail the same way: a consultant writes a policy set nobody reads, the certificate arrives, and the controls quietly stop operating. We implement management systems that survive the surveillance audit, because we run one ourselves.
Capabilities
From gap analysis to certificate
A complete implementation path, or any individual stage of it if you already have work in progress.
ISMS Design & Implementation
Scope definition, statement of applicability, risk methodology, and the full information security management system documentation set.
Risk Register & Treatment Plans
A living risk register with named owners, treatment decisions and review cadence — the artefact auditors examine first.
Policy & SOP Development
Security policies, standard operating procedures and business continuity documentation written in language your staff will actually follow.
Internal Audit & Management Review
Running the internal audit programme and management review cycle that the standard requires before certification.
Certification Support
Preparing evidence packs, coordinating with the certification body, and standing alongside your team through Stage 1 and Stage 2 audits.
Multi-Framework Compliance
Mapping a single control set across ISO 27001, NIST CSF, GDPR, PCI-DSS and SOC 2 so you implement once and report many times.
GRC Automation
Compliance monitoring, risk reporting and governance controls implemented as tooling rather than spreadsheets.
Security Awareness Programmes
Staff training that addresses the human controls the standard requires and auditors always sample.
Deliverables
What certification readiness looks like
We hand over a management system your team owns — not a document pack that decays the moment we leave.
- Scope statement and Statement of Applicability
- Risk assessment methodology, register and treatment plan
- Complete policy and procedure set, version controlled
- Asset inventory, access control matrix and supplier register
- Internal audit programme with completed first cycle
- Management review minutes and corrective action log
- Evidence pack indexed against every applicable Annex A control
ISO 27001
We hold the standard we implement
Behind the work
Frameworks we implement and audit against
We are deeply committed to upholding the highest levels of compliance, governance and ethical conduct across every engagement.
- ISO/IEC 27001:2022 — Information Security Management
- ISO 9001:2015 — Quality Management
- ISO 14001:2015 — Environmental Management
- ISO/IEC 27035:2023 — Incident Management
- NIST Cybersecurity Framework
- GDPR
- PCI-DSS
- SOC 2
- ITIL Framework
- CRISC
- CIPP
- HIPAA
Questions
Common questions
How long does an ISO 27001 implementation take?
For a mid-sized organisation with a contained scope, six to nine months from gap assessment to Stage 2 audit is realistic. The variable is not our effort — it is how quickly your own risk owners make decisions and evidence starts accumulating. The standard requires a period of operating records before certification.
Can you also certify us?
No, and no consultant honestly can. Certification is issued by an accredited certification body that must be independent of the implementer. We prepare you, coordinate the process and support you through the audit — but the auditor is theirs, not ours.
We failed a surveillance audit. Can you help?
Frequently. We start with the non-conformity report, establish whether the finding is a documentation gap or a genuine control failure, and build a corrective action plan against the audit deadline.
Do we need ISO 27001 to bid for government work?
Not always, but it increasingly appears in technical evaluation criteria and it removes an entire category of objection during bid scrutiny. It also gives you a defensible answer when a client asks how you protect their data.
Starting an ISO 27001 journey?
Begin with a gap assessment. It is a fixed-price engagement and it tells you honestly how far away certification really is.