Security & Assurance · ISO/IEC 27001:2022 Information Security Management
Issued by
ISO / IEC
Typical timeline
12-20 weeks
Assessed by
Accredited certification body
Validity
3-year certificate, annual surveillance
Overview
Who needs ISO 27001?
- 01Companies selling into Europe, the Middle East and Asia
- 02Enterprises needing a globally recognized certificate
- 03Teams that want a management system, not just a report
Requirements
What the auditor looks for.
- 01ISMS clauses 4-10Context, leadership, planning, support, operation, evaluation and improvement.
- 02Risk assessment & treatmentA documented methodology, risk register and treatment plan.
- 03Annex A controls93 controls across organizational, people, physical and technological themes, justified in a Statement of Applicability.
- 04Internal audit & management reviewEvidence the system checks and improves itself.
Our approach
From scoping to auditor sign-off.
Customer story
FAQ
Questions, answered.
It's different. ISO 27001 demands a management system, risk methodology, internal audit, management review, while SOC 2 focuses on control operation. With a unified control set, most of the work serves both.
Typical timeline: 12-20 weeks, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. ISO 27001 shares substantial control overlap with SOC 2 and ISO 27701, so we build one control set and map evidence across all of them.
Next framework
NIST CSF
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.