FAQs
ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
Organisations of any size, in any sector, that need to demonstrate they manage their customers' or partners' information securely, including those seeking to tender for major contracts or operate globally.
Certification provides global credibility, improves security posture, facilitates compliance with legal/regulatory requirements (like GDPR), and provides a competitive advantage.
What are the key components of this?
ISMS (Clauses 4-10): The system for managing security. Annex A (Controls): A catalog of 114 security controls (e.g., access control, cryptography) that must be assessed and applied where necessary.
Can you perform both the Readiness Service and the Final Audit?
No. Due to the ISO standard's independence rules, we cannot consult on the ISMS (Readiness) and then formally certify it (Audit). We offer one or the other to maintain integrity.
Can you perform both the Readiness Service and the Final Audit?
No. Due to the ISO standard's independence rules, we cannot consult on the ISMS (Readiness) and then formally certify it (Audit). We offer one or the other to maintain integrity.
Which service should we choose first?
If you are starting from scratch, the ISO 27001 Readiness Service is essential to build your ISMS correctly. The Final Audit is only suitable if your ISMS is fully implemented and operational.
How long does an ISO 27001 Audit take?
The audit is split into two stages. The total audit time depends on the size and complexity of your organization, but generally ranges from 3 to 10 days of on-site/remote auditing.
How long does an ISO 27001 Readiness take?
Implementing a new ISMS typically takes between 6 to 12 months depending on the complexity of the scope, current maturity level, and resources dedicated to the project.
