The international standard for an Information Security Management System (ISMS), what it actually requires, and exactly where we fit versus what stays with you.
ISO/IEC 27001:2022 is an international standard that specifies the requirements for an Information Security Management System (ISMS), a structured, ongoing way of identifying information security risks and managing them, not a one-off checklist. It sets out 93 Annex A controls spanning organisational, people, physical and technological security, and requires you to document, for every one of them, whether it applies to your business and how it's addressed.
Certification itself is issued by an independent, UKAS-accredited certification body (not by us, and not by NCSC) after a formal two-stage audit: Stage 1 reviews your documentation for readiness, Stage 2 examines whether your controls are genuinely operating as documented. Certified organisations are then subject to annual surveillance audits and full recertification every three years.
Increasingly a hard requirement in enterprise vendor risk assessments and public sector procurement, many larger organisations simply won't onboard a supplier without it, or will fast-track one who has it.
It's also the most internationally recognised of the three frameworks on this page, which matters if you work with clients outside the UK.
Every policy and procedure document an ISMS needs, built from your real answers rather than a generic template, covering all 14 Annex A control themes.
The core ISO 27001 deliverable, a genuine, control-by-control applicability and justification record across all 93 Annex A controls, not a static one-time export.
A working risk register and an improvement plan tracking what's still outstanding, the evidence an auditor expects to see being actively used, not filed away.
Documented incident response testing, evidence that your response plans have actually been exercised, a common Stage 2 audit question.
Update an answer and we automatically flag every document it affects. For real-world changes we wouldn't otherwise know about, a new supplier, a dropped control, tell us via your quarterly Narrative Check, keeping your ISMS documentation genuinely matched to your live business, between audits and after certification.
The reporting an ISMS's periodic management review needs, real completion data and gap tracking, not a document nobody looks at again.
Implementing the actual technical controls the policies describe, firewalls, MFA, endpoint protection, backups, patching, in your live IT environment, typically with your internal IT team or MSP.
Operating the ISMS day to day: holding the management reviews, running the internal audits, and acting on the risk register and improvement plan we give you the structure for.
Engaging and paying a UKAS-accredited certification body directly for the Stage 1 and Stage 2 audits. We are not a certification body and don't perform or broker that audit, our job is making sure you walk in with the policies, evidence and documentation genuinely in place. The technical and operational controls those policies describe are still yours to implement.
Think of it as the difference between the paperwork and the plumbing. We give you a genuinely current, control-by-control ISMS documentation set that reflects your real business, the paperwork an auditor actually wants to see, kept accurate as you change. Whether the technical controls those documents describe are actually switched on in your Microsoft 365 tenant, your firewall, your backup solution, that's your environment, run by you or whoever manages your IT, and it's the part no documentation platform can do for you.
ISO 27001 certification isn't a single event - it's a two-stage audit, followed by an ongoing surveillance cycle that doesn't stop once you're certified.
Your certification body reviews your ISMS documentation - policies, Statement of Applicability, risk register - to confirm you're genuinely ready for the full audit, not just to check a box. Gaps found here get fixed before Stage 2, not during it.
The auditor examines whether your controls are actually operating as documented - interviewing staff, sampling evidence, checking that what's written down matches what your business genuinely does day to day.
Annual surveillance audits check the ISMS is still live and maintained, not filed away after certification. Full recertification happens every three years, repeating the depth of the original assessment.
ISO/IEC 27001:2022's Annex A restructured the controls into four themes - useful for understanding the real shape of what you're documenting, beyond just "93 controls."
The largest group - policies, roles and responsibilities, supplier relationships, incident management and legal/regulatory compliance requirements.
Screening, terms of employment, security awareness and training, and disciplinary processes - the human side of an ISMS.
Physical entry, protection against environmental threats, equipment security and secure disposal.
Access control, cryptography, backups, logging, malware protection and secure development - the controls most likely to overlap with what Cyber Essentials already covers.
Unlike Cyber Essentials, ISO 27001 doesn't have a fixed price tier - certification body fees are typically based on audit days, which scale with the size and complexity of what's in scope.
Priced per auditor day for Stage 1, Stage 2 and annual surveillance visits - broadly proportional to headcount and how many sites or systems are in scope.
The bigger cost variable is everything before the audit even starts: whether you build the documentation yourself, hire a consultant at a day rate for months, or use a platform - and whether the ISMS keeps itself current afterward or quietly goes stale until the next audit forces a scramble.
Where we fit: the documentation build and the ongoing currency of your ISMS - not the audit fee itself, which always goes directly to your independent certification body. See current pricing →
The full ISO 27001, CAF and Cyber Insurance policy pack, built from your core questionnaire.
Not sure if you need this or Cyber Essentials? See the comparison →