Measure where you stand
Interviews, document review and a control-by-control gap report against ISO/IEC 27001:2022, with an effort estimate for each gap.
// ISO/IEC 27001:2022Get ready for your
Get ready for your
ISO 27001 certification audit.
We take you from a gap assessment to a working information security management system: scope, risk assessment, Statement of Applicability, controls in place, internal audit and management review done before the certification body arrives.
ISO/IEC 27001:202293 Annex A controlsStage 1 and Stage 2 readyInternal audit included
93Annex A controls in the 2022 edition
4Control themes: organisational, people, physical, technological
3 yrsCertificate cycle, with annual surveillance audits
// WHAT ISO 27001 ACTUALLY ASKS FOR
A management system you run, not a folder of policies.
ISO 27001 certifies the way you manage information security: clauses 4 to 10 describe the system (context, leadership, planning, support, operation, performance evaluation and improvement), and Annex A lists 93 controls in four themes (organisational, people, physical and technological). An auditor looks for evidence that the system runs. Our job is to help you build it, run it for long enough to produce that evidence, and fix the gaps before Stage 1.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Put the ISMS in place
Scope, risk assessment, Statement of Applicability, policies and control implementation with your team, tracked week by week.
Produce the evidence
Run the controls long enough to create records an auditor can sample, then complete the internal audit and management review.
Stage 1 and Stage 2
Help choosing an accredited certification body, readiness review before each stage, and support closing any nonconformities they raise.
// PROJECT OUTPUTS
What your team can take into the next review.
- ISO 27001:2022 gap report with prioritised actions
- Risk register, risk treatment plan and Statement of Applicability
- ISMS policy set and mandatory documented information
- Internal audit report and management review minutes
- Certification-body shortlist and audit-day preparation
// BUILT FOR
Designed around the people who own the outcome.
- Founders and CTOs answering enterprise security questionnaires
- CISOs and IT heads preparing a first certification
- Teams bidding for tenders that require ISO 27001
- Organisations moving from the 2013 edition to 2022
Scope and context
We define the ISMS scope with you (sites, teams, products, cloud services and suppliers) and record interested parties and their requirements, so the certificate covers what your customers actually ask about.
Risk assessment and treatment
A risk method you can repeat, an asset and risk register, and a treatment plan with owners. This is the part auditors read most closely, and the part most templates get wrong.
Statement of Applicability
Every one of the 93 Annex A controls marked applicable or excluded, with a reason and a pointer to how it is implemented. We keep it in step with your risk treatment plan.
Policies people can follow
The mandatory documented information plus the policies your controls need, written for your size and tooling. Short enough to be read, specific enough to be audited.
Internal audit and management review
A full internal audit against clauses 4-10 and Annex A, nonconformities raised and closed, and a management review with minutes, the two records certification bodies check first.
Evidence in one place
Controls, owners and evidence tracked in the Bitkosh Readiness Platform, so surveillance audits in years two and three reuse the same records instead of starting again.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
Gap assessment
Talk to us
A fixed-scope review with a written gap report and roadmap. Useful on its own if you plan to implement in-house.
Full readiness programme
Talk to us
Gap assessment to certification-audit support. The certification audit fee is billed separately by the accredited certification body you appoint.
Every ISO 27001 engagement is scoped to your organisation: size, number of sites, how much of the ISMS already exists and how quickly you need the certificate. Talk to us and we'll send a written proposal.
Frequently Asked Questions
Do you issue the ISO 27001 certificate?
No. ISO 27001 certificates are issued by accredited certification bodies after a Stage 1 and Stage 2 audit. We prepare you for that audit and can help you shortlist certification bodies, but we do not certify you ourselves, and we are not paid by the certification body.
How long does ISO 27001 readiness take?
It depends on your size and how much is already in place. The longest part is usually operating the controls long enough to produce evidence an auditor can sample. We give you a week-by-week plan after the gap assessment instead of a number before we have seen anything.
We are certified to ISO 27001:2013. What changes?
The 2022 edition regrouped Annex A into 93 controls in four themes and added new ones such as threat intelligence, cloud services and data leakage prevention. We map your existing controls to the 2022 structure and close only the gaps, rather than rewriting everything.
Do we have to use the Bitkosh Readiness Platform?
No. It is included if you want it, and it saves time at surveillance audits, but we can work with the tools and document system you already have.
Can ISO 27001 work count towards SOC 2 or the DPDP Act?
Yes, partly. Many controls overlap, and the platform maps evidence across frameworks so one piece of evidence can serve several. See our SOC 2 readiness and DPDP Act compliance services for what each adds.
Let's build together
Walk into Stage 1 knowing what the auditor will find.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.