ISO 27001 Implementation

Cerificate

We’ve been through this process ourselves, and we know the worst part is the picture in your head before you start.

Before we implemented ISO 27001 internally, we had the same concerns you probably do: how long will it take, how much paperwork, how will the team react. The reality turned out differently — we brought order to processes we should have had in place anyway, and we passed the DEKRA certification audit without a single major non-conformity. The methodology we apply with clients is exactly the path we walked ourselves, including the moments when we, too, felt like giving up.

Turn a compliance requirement into a competitive advantage

ISO 27001 is the world’s most widely recognised standard for information security management. Implementing it genuinely raises your security posture, and the certificate proves it to your clients and partners. As a company that has been through this process ourselves, we implement an Information Security Management System (ISMS) in your organisation and guide you step by step — from gap analysis, through documentation and security controls, all the way to the audit by an independent certification body.

LET’S TALK
Challenges

Common challenges in ISO 27001 implementation

For many companies, the road to certification looks much the same:

Externally imposed time pressure

ISO 27001 certification becomes a condition for signing a contract, entering a tender, or a requirement from a key client. The deadline is fixed, and the process has to be delivered fast and without mistakes.

Documentation that paralyses the team

The standard requires dozens of policies, procedures and records, from the Statement of Applicability to the risk register. Without experience, it’s easy to get stuck producing documents that don’t reflect how the company actually works.

No in-house expertise or capacity

Implementing an ISMS is several months of work and requires knowledge of both the standard and real-world audit practice. Day to day, your IT team has priorities other than writing security policies.

Risk of non-conformities during the certification audit

An underdeveloped information security management system leads to non-conformities during the audit, and the certification body may refuse to issue the certificate or make it conditional on closing those non-conformities within a set deadline.

Starting not from zero, but after a setback

Some companies come to us after a failed audit, a security incident, or blunt feedback from a client or investor. There’s no time for a textbook implementation from scratch — the organisation’s maturity has to rise quickly and show real improvement, not just another policy on paper.

case study

See how it works in practice

Client:

A MedTech company preparing for ISO 27001 certification.

Challenge:

The company needed to quickly identify and close gaps in its information security management processes in order to meet the requirements of the standard and earn the trust of key clients.

Solution:

We ran a comprehensive gap analysis against ISO 27001, built the full ISMS documentation set from the ground up — including the risk register and the Statement of Applicability — and then carried out an internal audit with a prioritised remediation plan.

Results:


15 critical non-conformities identified and closed before the external audit.

Preparation time for the certification audit reduced by 3 months.

External audit passed successfully and ISO 27001 certification achieved.

Your company can go through this process just as smoothly, without the chaos.

LET’S TALK See other implementations
Our service

End-to-end implementation of an Information Security Management System

We guide you through the entire process. We don’t just advise, we actually implement the required policies, processes and technical controls.

Definition: an analysis of external factors (e.g. law, technology, the market) and internal ones (e.g. company culture, structure, resources), together with a definition of the needs of interested parties (clients, authorities, employees).
This is a precise picture of the environment your company operates in and the terms on which it competes. At this stage we identify all applicable legislation, regulatory requirements and the specific business expectations of your clients and partners. We also analyse your internal culture, structure and technology resources. The business goal is simple: the ISMS should address the risks that actually apply to your company, so that it protects you from regulatory penalties, reputational damage and the consequences of failing to meet contractual commitments.

We help you set hard, unambiguous boundaries for security procedures across your organisation. This document states precisely which physical locations, IT systems, applications and teams are covered by certification and protection. That makes it clear to auditors and clients exactly which processes your company takes full responsibility for. Financially, scope acts as a budget filter. It extends protection only to the systems and locations your revenue depends on.

We help you build an asset register, which becomes the foundation of the entire system

We assess your organisation’s current state against all 93 controls in Annex A of ISO/IEC 27001:2022 and pinpoint exactly what’s missing.

We produce the complete required documentation set: the information security policy, the risk register, and procedures for incident management and business continuity, tailored to the real scale and processes of your company rather than copied from a template. We also prepare the Statement of Applicability, the document auditors ask about most often, with full justification for every decision, not as a formality to be signed off at the end.

ISO implementations usually die in Excel, because a file with a task list has no owner and no deadline, and after two weeks nobody opens it. That’s why we move the entire implementation plan, the risk register and the Annex A checklist into the task management system your team already uses. Progress is visible as it happens, not only in a report at the end of the project.

We identify, assess and prioritise risks using the methodology the standard requires, building a risk register that genuinely supports business decisions.

We put the controls required by the standard into practice: access control, identity management, backups, monitoring and more. We draw on our DevOps and cybersecurity expertise to do it.

We run an internal audit that simulates what the certification body will do, close the non-conformities, and prepare both your team and your documentation for the external auditor.

The standard requires the ISMS to stay alive: management reviews, internal audits, the PDCA cycle. Without that you won’t keep the certificate, and in practice it ends in a frantic rebuild of documentation just before the surveillance audit. That’s why we offer to take on the role of ISMS manager as part of CISO as a Service ,someone who keeps track of deadlines, reviews and updates, so the audit becomes a formality.

If you also fall under NIS2 or DORA, we extend the programme to cover the additional requirements (supplier risk management, resilience testing) within the same project and budget, instead of running two parallel implementations.

Methodology

Your route to ISO 27001 certification

We work to a proven six-stage methodology, the same one that got us our own ISO 27001 certificate:

1.

Diagnosis

We run a detailed gap analysis against the requirements of the standard and Annex A.

2.

Planning

We build an implementation roadmap with a schedule, the ISMS scope and a clear split of responsibilities. We spin up a ready-made project template in Jira, so from day one your team has tasks laid out rather than a blank page.

3.

Building the system

We develop the documentation and risk register, and implement the required technical and organisational controls.

4.

Putting it into practice

The system starts working in the company’s day-to-day operations, not just on paper, and we collect evidence that it functions: records of reviews, tickets handled, training delivered. The absence of that evidence is one of the most common causes of non-conformities during an audit.

5.

Internal audit and corrections

We test the system in practice, then identify and close non-conformities before the external auditor arrives.

6.

External audit and certification

We’re with you throughout the audit by the independent certification body (only they can issue the certificate itself). That’s the day you hold your ISO 27001 certificate and we help you keep the system running through the surveillance cycles that follow.

RELATED SERVICES

Other services you may find useful

Risk Analysis and Security Audits
Przejdź
NIS2 and DORA Compliance
Przejdź
CISO as a Service
Przejdź
Identity and Access Management (IAM)
Przejdź
Q&A

Frequently asked questions

It depends on the size and maturity of the organisation, but a typical process from gap analysis to certification audit takes 4–9 months.

It’s an excellent foundation, but NIS2 and DORA introduce additional, detailed obligations (for example around supply chain management and resilience testing) that go beyond the standard itself. We can extend the implementation to cover them.

No. The standard allows you to exclude controls that aren’t relevant to your organisation, but you have to justify that in the Statement of Applicability (SoA). We help you make those decisions deliberately.

No — the certification audit is performed by an independent, accredited certification body. We prepare your company so that this audit ends in success, and we can recommend certification bodies we’ve worked with.

Both. If you’ve already had a failed audit, a security incident, or blunt feedback from a client or investor, we start by assessing what you already have and quickly close the most urgent gaps. You don’t need to start from scratch.

Risk analysis and audits are targeted diagnostic exercises (a risk assessment, an internal audit). ISO 27001 Certification Readiness is a full programme run from A to Z: from diagnosis, through building the entire management system, to support on the day of the certification body audit and in maintaining the system afterwards.