ISO 27001 Consulting

We guide you along the entire path to ISO 27001 certification: from scope definition through risk assessment, Statement of Applicability and internal audits to the certification audit by the accredited body. Along the way, we build an ISMS that fits your organization and is lived day to day, instead of just ticking off the standard.

ISO 27001 is the internationally recognized standard for information security management systems, and in many situations the required proof: when major customers make a certificate a condition, in tenders, as solid evidence of the risk management obligations under NIS2, toward cyber insurers, or simply as a visible signal to the market and partners that information security is run systematically.

It is just as clear that not every organization needs a certified ISMS. Without an obligation to provide proof, the route via the CIS Controls often leads to real security faster, and anyone who needs the certificate later after all loses nothing. Whether certification pays off for you is something we clarify honestly in the initial consultation, even if the answer is: not yet.

An ISMS under ISO/IEC 27001:2022 consists of clearly identifiable building blocks, from the scope through risk management to continual improvement. We work along the structure that the implementation guide of the ISACA Germany Chapter also describes; each building block is shaped to fit the size and maturity of your organization. The colors show the phase in the PDCA cycle (Plan, Do, Check, Act) that the standard follows, making it visible that an ISMS is a cycle, not a stack of documents:

Our ISO 27001 consulting starts with a gap analysis against the standard: what is in place, what is missing, what is oversized? This results in a prioritized implementation plan along the building blocks, and then we build together: scope and context, risk methodology and risk assessment, Statement of Applicability, policy and guidelines, implementation of measures, metrics and management review. We conduct the internal audit independently, with solid findings instead of a courtesy report.

We guide you through both stages of the certification audit by the accredited body, from the document review (Stage 1) to the on-site audit (Stage 2), and stay on board afterwards if you wish: for surveillance audits, the further development of the ISMS or as an external information security officer. We know both sides of the table, from many passed audits as consultants and as auditors.

The standard requires a risk-based approach, but it does not say which risks are real for your organization. This is exactly where our approach differs: we prioritize risk assessment and the selection of measures along the techniques your actual adversaries use (Threat-Informed Defense). As the technical backbone of the Annex A implementation, we use the CIS Controls where they fit, whose effectiveness against real attack techniques has been measured.

The result: an ISMS in which every measure has a traceable justification, toward the auditor and toward management. Compliance emerges as the documented result of effective security, not as its starting point.