ISO 27001:2022 Consulting & Certification Readiness
ISO 27001 consulting focused on standing up a real Information Security Management System (ISMS) — not a shelfware binder. We help you scope the ISMS, run a defensible risk assessment, map Annex A controls to your operations, and get certification-ready with a Stage 1 / Stage 2 auditor.
Common reasons teams come to us
- An EMEA or enterprise buyer requires ISO/IEC 27001:2022 certification to move forward.
- The team already has SOC 2 and wants to reuse evidence for ISO 27001 without duplicating work.
- An inherited ISMS exists on paper but no one operates it — internal audit and management review are overdue.
- Scope, risk methodology, and Statement of Applicability need to be defensible ahead of Stage 1.
- Annex A 2022 controls have not been re-mapped since the standard update.
- A certification body has been selected and the Stage 2 audit date is now on the calendar.
- SaaS and fintech teams pursuing ISO/IEC 27001:2022 certification
- Payments and health-tech companies with EMEA or regulated B2B buyers
- Teams selling into EMEA where ISO 27001 is table stakes
- Companies aligning SOC 2 and ISO 27001 evidence to reduce duplicate work
- Security leaders replacing an inherited ISMS that no one actually runs
- ISMS scoping — products, locations, and third parties in and out of scope
- Information security risk assessment and risk treatment plan
- Annex A (ISO 27001:2022) control selection and mapping
- Statement of Applicability (SoA)
- Policy, procedure, and record set aligned to clauses 4–10
- Internal audit and management review support
- Certification body selection and Stage 1 / Stage 2 audit prep
What ISO 27001 readiness covers
ISMS scope & context
Products, locations, teams, and third parties clearly in or out of scope for the ISMS.
Risk assessment & treatment
Defensible risk methodology, assessment, and treatment plan aligned to clauses 6 and 8.
Annex A (2022) mapping
Control selection across the four 2022 themes, mapped to how you actually operate.
Statement of Applicability
Complete SoA justifying inclusion and exclusion of every Annex A control.
Policies, procedures & records
Right-sized policy set and evidence trail aligned to clauses 4–10.
Internal audit & management review
Working internal audit programme and management review pack ready for Stage 1.
- Turn ISO 27001 into a working management system, not a compliance shelf
- Reuse SOC 2 evidence where possible to reduce duplicate effort
- Enter Stage 1 confident in scope, SoA, and risk methodology
- Give sales a certification badge enterprise and EMEA buyers expect
- ISMS scope statement
- Risk assessment, treatment plan, and Statement of Applicability
- Policy set and procedure library
- Internal audit plan and management review pack
Four steps from scope to action
- 01
Define the scope
Confirm the ISMS boundary across products, locations, teams, and third parties.
- 02
Assess the environment
Review risks, Annex A controls, policies, records, and operating evidence.
- 03
Prioritize the findings
Rank gaps by certification impact, security risk, and implementation effort.
- 04
Deliver the action plan
Provide the ISMS, evidence, internal-audit, and certification-preparation plan.
Questions we hear most
Explore other ControlSolid services
- SOC 2 Type 1 & Type 2 readiness →Reuse ISMS controls and evidence to reduce SOC 2 duplication.
- Security assessments & gap analysis →Pre-ISMS baseline against NIST CSF, CIS Controls, and ISO 27001 Annex A.
- Application & cloud security reviews →Cloud and SDLC evidence that feeds directly into Annex A technical controls.