ISO 27001: implementing and certifying your information security management system

We support you from the gap analysis through to the certification audit. We design an ISMS that genuinely works in your company, without unnecessary bureaucracy and without losing focus on what matters: reducing real risk.

Scope your project · Start an ISO 27001 project

Rather talk it through? Call us at +34 960 730 013

The problem with ISO 27001 projects that fail

Most failed ISO 27001 projects share the same pattern: a consultant delivers a pack of generic documents, the team signs them off without understanding them, and when the external auditor arrives the policies bear no relation to reality. Documenting for the sake of documenting does not reduce risk. We start with an honest gap analysis and build an ISMS that reflects how your company actually works, that the team understands and that the auditor validates.

ISO 27001 project phases

  • Gap analysis: current posture vs. Annex A controls (ISO 27001:2022)
  • Definition of the ISMS scope and the security policy
  • Risk assessment and treatment (ISO 31000 or MAGERIT methodology)
  • Statement of Applicability (SoA)
  • Implementation of technical and organizational controls
  • Drafting of policies, procedures and records
  • Internal audit prior to certification
  • Support during the external audit (Stage 1 and Stage 2) with bodies such as AENOR, Bureau Veritas or DNV

Our approach

  1. Honest gap analysis: We assess your real posture against the 93 controls of Annex A of ISO 27001:2022. No glossing over reality.
  2. Well-defined scope: Too broad and you never get there; too narrow and the certificate is useless for what you need. We define it precisely.
  3. Realistic risk management: We build the asset inventory and the risk assessment based on your operational reality, not on generic templates.
  4. Functional documentation: Policies and procedures designed to be useful and applicable, not to gather dust in a drawer.
  5. Audit readiness: We simulate the external audit and fix the deviations before the real auditor arrives.

Project deliverables

  • Gap analysis report with a gap map
  • Information Security Policy
  • Risk assessment methodology and results
  • Statement of Applicability (SoA)
  • Complete documentation pack (30+ documents)
  • Pre-certification internal audit report

Who asks us for ISO 27001?

  • SaaS firms and startups that need certification to win enterprise clients or public tenders
  • Professional services firms (legal, consulting, audit) that handle confidential data
  • ICT suppliers to public administrations that need ISO 27001 as an alternative or complement to the ENS
  • Industrial companies with connected OT systems looking to extend the ISMS to production environments
  • Organizations already working on NIS2 or DORA that want to integrate ISO 27001 by leveraging common controls

Frequently asked questions about ISO 27001

ISO 27001:2013 or ISO 27001:2022? Do we need to migrate?

The current version is ISO 27001:2022. Certificates issued under the 2013 version had until October 2025 to migrate. If you're just starting, go straight for the 2022 version.

How many internal resources does the project require?

You need an internal owner (usually the CISO or IT manager) with around 4 to 8 hours per week. The technical team takes part occasionally during the implementation of controls.

Does the ISO 27001 certificate have an expiration date?

The certificate is valid for 3 years, with annual surveillance audits (years 1 and 2) and a recertification audit in year 3.

Can you look after the ISMS after certification?

Yes, except for the surveillance audit itself, which the same certification body carries out every year. What we do is everything that audit will review: the internal audit required by clause 9.2, the management review, updating the risk assessment and the Statement of Applicability as the business changes, and preparing the year-three recertification.

How long does it take to implement ISO 27001 through to certification?

With a narrow scope (one product, one service or one site), 3 to 6 months to the certification audit; with broad scopes or several sites, 6 to 12 months. What stretches the project is not writing the policies but giving the controls enough time in operation to produce the records the auditor will want to see in Stage 2.

Which certification body do you work with?

We don't issue the certificate ourselves: due to role incompatibility, whoever helps you implement the ISMS cannot also certify it. We support you in choosing among ENAC-accredited bodies — AENOR, Bureau Veritas, DNV and others — and provide technical support throughout the external audit, whichever one you choose.

Related resources

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Start an ISO 27001 project