ISO/IEC 27001:2022: Build a security management system your organisation can run.
ISO 27001 readiness helps your organisation establish an information security management system and prepare for an independent certification audit. We support the scope, risk assessment, control implementation and evidence needed to make that system work in practice, with responsibilities and review processes your organisation can sustain.
- Discipline
- Governance, Risk & Compliance
- Engagement type
- Advisory
The certificate has a scope. The work needs to match it.
A customer may ask for ISO 27001 while your organisation is still deciding which services, locations and teams to include. We start with those boundaries and the information you need to protect, so the management system reflects the business being assessed.
Context and responsibilities
Define the ISMS scope, interested parties, relevant obligations and the people responsible for decisions and recurring activities.
Risk and control decisions
Assess information security risks, record how they will be treated and build a Statement of Applicability explaining control selection and exclusions.
Policies in operation
Develop or improve procedures for the agreed scope, with implementation support across areas such as access, suppliers, incidents and continuity.
Review and improvement
Prepare for internal audit and management review, track corrective actions and establish how performance and changes will be reviewed.
From an initial gap review to a working ISMS.
We review existing practices before introducing new documents. The gap assessment becomes a work plan with owners, dependencies and the records each activity should produce. As controls are introduced or improved, we check that the records reflect what people actually do. An objective internal audit and management review help identify remaining issues before the certification assessment.
What you receive
Defined ISMS scope
Boundaries, responsibilities and an inventory of the documents and records needed.
Risk and treatment records
A risk assessment, treatment plan and Statement of Applicability aligned with the agreed scope.
Implementation and review records
Agreed policies, supporting evidence, corrective actions and preparation for management review and internal audit.
Does Subdux issue the certificate?
No. We support implementation and readiness. A separate certification body conducts the certification audit and makes the certification decision.
Do we need every Annex A control?
Control selection follows the risks and obligations within your scope. The Statement of Applicability records which controls are necessary and the justification for inclusion or exclusion; it is not a checklist to accept or reject without explanation.
Can you work with an existing ISMS?
Yes. We can review an existing management system, address audit findings or help adapt it after changes to your services, people or technology. Work already in place should be evaluated before being replaced.
Preparing for a customer requirement or certification audit?
Tell us which part of the business needs to be covered, what is already in place and any dates you are working towards.
Related services: SOC 2 Readiness and NIST CSF.