ISO 27001 from gap analysis to certification

Who it is for and when

Suits organisations heading for ISO 27001 certification, or that need a management system they can show a customer or owner, and that want it to work in daily operations rather than sit in a binder.

• A customer or owner requires ISO 27001, or a management system you can demonstrate.
• You have policies but no coherent management system.
• Risk work lives in a spreadsheet and is rarely updated.
• You want to certify but do not know what remains or in what order.

What we do

1. Gap analysis and scope. We establish the scope of the management system and assess the current state against the standard, requirement by requirement, so the work starts at the right end.
2. Risk method and risk work. A risk method the business can actually use, with risk criteria, a risk register and risk treatment plans that can be kept current.
3. Policies and controls. Policies, routines and the control structure are developed from your risk profile, with a Statement of Applicability showing which controls apply and why the others do not.
4. Implementation in the business. Controls are implemented where the work is actually done, with training and with the evidence the audit will ask for.
5. Internal audit, management review and pre-audit. The internal audit is carried out by a person who was not involved in the parts being audited, so that objectivity and impartiality can be ensured. We support the management review and run a pre-audit, so that nonconformities are found before the certification audit.

How long it takes

It depends above all on the size and complexity of the organisation. A smaller organisation can at best be ready within twelve months. For a medium-sized or more complex organisation twelve to twenty-four months is a realistic range, and a larger organisation usually needs twenty-four to thirty-six months. What sets the pace is how quickly the business can implement the changes, not the consultancy effort.

On top of building the management system, three steps take their own time: the internal audit by an independent party, the remediation of what that audit finds, and planning and carrying out the certification audit with the certification body.

1. Gap analysis and scope: a few days to a week. The current state against the standard, and a timeline for the rest of the work.
2. Risk work, policies and Statement of Applicability. The risk method is used for real and decides which controls are needed.
3. Implementation in the business. The part that varies most, because this is where routines, technology and responsibilities actually change.
4. Internal audit, remediation and management review. The internal audit is carried out by an independent party that does not audit its own work. Its findings are remediated, and the management review is completed, before the certification audit.
5. Certification audit in two stages. In stage 1 the certification body reviews the documentation and whether you are ready; in stage 2, whether the management system works in practice. The certification body needs to be booked in good time.

The certificate is valid for three years, with a surveillance audit every year and recertification in the third year. We set a timeline for you in the gap analysis.

Scope and price

A project that normally runs over several months, depending on the size of the organisation, the scope of the management system and how much is in place when we start.

The price varies from engagement to engagement and depends on the scope above. You get an estimated cost proposal and, where possible, a fixed price. The certification audit is carried out by an accredited certification body and their fees fall outside the engagement. What the whole road costs, including your own time and the certification body’s fees, is described in the guide What does ISO 27001 certification cost?.

How it works

1. A first conversation. We listen to your situation and explain how we usually set up the work. You get our assessment straight away, free of charge.
2. A proposal with scope and price. A short written proposal with what is included, what you get, who does the work and what it costs.
3. Delivery and handover. We work together with your organisation, report continuously and hand over so that you can maintain the result yourselves.