ISO/IEC 27001 — Information Security Management System
An ISO/IEC 27001 audit almost always opens on the same document: the Statement of Applicability. From it the auditor traces which Annex A controls are applied, why any are excluded, and where the evidence for each applied control lives — and the moment the statement and the practice diverge, the rest of the audit follows that gap. Our readiness work fixes the scope and the asset inventory, ties the risk assessment and treatment plan to the controls, and produces the Statement of Applicability as the output of that chain rather than as a form filled in at the end. The controls introduced by the 2022 revision, and supplier and cloud service assurance, are where most organizations are shortest of evidence.
Readiness carried alone by the IT team struggles in the audit: access authorization, supplier contracts and incident reporting produce no evidence unless they are built together with HR, procurement and legal.
Get a quote now-
Determining the scope (cl. 4.3) and the asset inventory (A.5.9)
-
Information security risk assessment and treatment plan (cl. 6.1.2, 6.1.3)
-
Statement of Applicability (SoA) and justifications
-
Implementation and evidence of Annex A controls
-
Supplier relationships and cloud service assurance
-
Information security incident management and business continuity
Request a proposal for audit preparation
We prepare the scope, work plan and proposal around your audit schedule and needs.