ISO 27001
Security management, proportionate to your actual risk
If you are not a bank. Your controls should not pretend otherwise.
Most ISO 27001 projects are bigger than they need to be
The standard is deliberately flexible. Implementations often are not, usually because the template someone started from was written for a larger organisation with a security team.
The result is a control set nobody maintains, an evidence burden nobody sustains, and a surveillance audit that arrives like a deadline nobody planned for.
I have rebuilt an organisation’s entire IT environment from nothing, two weeks after ransomware destroyed it. That informs what I think is worth doing and what is not.
ISO27001 is purposely designed to closely follow the same process as ISO42001, ISO9001 and others so evidence and artifacts can be shared.
What you get
A scope you can defend
A maintenance rhythm
Risk-based control selection
Annex A considered properly, not adopted wholesale.
The documentation set
Policies, statement of applicability, risk register, procedures.
Evidence built as you go
Not assembled in a panic the week before an audit.
Internal audit and management review
The two things most implementations under-do.
CarA maintenance rhythmd Title
What happens each year, documented, so it survives someone leaving.
How it works
- Scope and gap assessment. Where you are, what the standard asks, what it will cost to close.
- Plan against your deadline, not a generic project template.
- Build alongside your team, so they understand what they are operating.
- Map to existing systems. If you have ISO 27001, much of the management-system machinery already exists.
- Internal audit, then fix what it finds.
- Certification support. Ready for the auditor, and present when they ask the awkward question.
Who it is for
- Organisations whose clients have started asking for certification
- Contracted providers who need it as a condition of a Deed
- List Item #1Anyone certified to the 2013 version who has not yet transitioned
ISO 27001:2013 is no longer valid
Certificates issued against the 2013 version stopped being valid on 31 October 2025.
Any organisation requiring certification has needed a current ISO 27001:2022 certificate since 1 November 2025.
If you are working from documentation written before the transition, some of it is out of date.
Not sure where to start?
Tell me what you're facing. You'll get a straight answer on whether this is the right piece of work, and what it would involve.