ISO 27001 certification support, from gap analysis to audit
From gap analysis to the certification audit.
ISO/IEC 27001:2022 sets out the requirements for an information security management system. Certification is issued by an accredited certification body, following a two-stage audit: a document review, then verification that the system is effectively in operation.
The support prepares you for that audit. It sets a relevant scope, conducts the risk assessment and produces the statement of applicability, which justifies the choice of controls among the 93 in Annex A. The system is then run for real, because the auditor checks what is done, not only what is written.
Certification remains the decision of the certification body. The support does not guarantee it; it puts you in a position to pass with a robust system, understood by your teams and maintainable after the audit.
What you get
- Initial gap analysis and scope of the management system
- Risk assessment method and report, risk treatment plan
- Statement of applicability justifying each Annex A control selected or excluded
- Policies and procedures required by the standard
- Internal audit, management review and preparation for the certification audit
How it runs
Gap and scope
Assessment of the current state against the requirements of the standard, and selection of a scope consistent with your business objectives.
Building the system
Risk assessment, statement of applicability, policies and roles. Documents are written to be used, not to fill a binder.
Going live
Controls are applied and produce their first records. An internal audit and a management review are conducted, as the standard requires.
Certification audit
Preparation of your teams, support through both stages of the audit, and handling of any nonconformities raised by the certification body.
Frequently asked
Why 3 to 9 months?
It depends on the size of the scope and your starting maturity. The system also needs to run for a period before the audit so that it produces evidence. The planned duration is fixed at scoping.
Does Valtieri issue the certification?
No. Only an accredited certification body can issue it. The role of the support is to prepare you for it; it cannot carry out the certification audit itself.
What happens after certification?
Certification is followed by regular surveillance audits by the certification body. The system must therefore keep running: risk reviews, internal audits and continual improvement.
In the same practice area : Security
- Posture assessment
Where you stand, and what is missing.
- Compliance programme
Measures deployed, documented, provable.
- Fractional CISO
Accountability sits with management. We carry the file with them.
- Security tooling integration
A tool installed is not a tool in service.
- Penetration testing
Find the flaws before those who are looking for them.
- Awareness training and phishing simulations
The first attack vector is still people. They can be trained.
- Incident response retainer
When an incident happens, you know who to call.
Let us talk about your context.
Thirty minutes to qualify the need. The written scope follows within fourteen working days.
Request a call