Cyber Security
An information security management system built for audit and useful afterwards: scoped tightly, written around how your team works and prepared for your certification body.
01Who it's for
A certificate shows customers that information security is managed, measured and improved. The real work is building an ISMS your team can keep running after the audit.
02What's included
Assess & scope
We compare your current policies, processes and controls with ISO/IEC 27001:2022 clauses 4 to 10 and the 93 Annex A controls. You get a clear list of what is missing and how much work each gap needs.
We help you define the ISMS scope, the interested parties and the business context the standard requires. A tight, realistic scope helps keep certification achievable and your audit costs under control.
Audit readiness
We run an internal audit and a management review before your certification body arrives, so findings can be closed early and your team knows what to expect.
Design the ISMS
We run a cyber risk assessment of your core business processes with your team, then build a risk treatment plan that links each risk to the controls you choose to apply.
A Statement of Applicability that records which Annex A controls apply, why, and how each is implemented. Auditors read this document closely, so we check it matches what you actually do.
Policies, procedures and records sized for your organisation, written so staff can follow them. Each document reflects how your organisation actually works, rather than a generic template that no one reads.
Cyber Security
An ISMS struggles at audit when its policies describe a business that doesn't exist. We write procedures around how your team already works, in plain language, then tighten them where the standard or your risks require it.
03In detail
We run our own ISMS, keep our own risk register and go through surveillance audits ourselves. That changes the advice you get. We know which documents auditors actually read, which records you must keep, and how to keep the ISMS light enough that your team maintains it after certification.
A copy of our ISO/IEC 27001:2022 certificate is available on request (see Our own certification below).
ISO/IEC 27001:2022 has two parts that work together:
The standard requires continual improvement (clause 10); many organisations run this as a plan, do, check, act cycle. Certification is not a one-off event. After the initial certification audits, the certification body returns for surveillance audits, and the certificate is renewed through a recertification audit.
Building an ISMS is more than writing policies. The five stages, from gap assessment to certification support, are set out in How it works below.
Where your team has the time, they do more of the work and we guide. Where they don’t, we carry more of it. Either way, you own the ISMS at the end.
ISO 27001 is a management system: it tells you how to govern and improve security. ASD Essentials, the Australian Signals Directorate’s framework, sets out the technical and capability outcomes ASD prioritises, and ASD’s assessment evidence guide lists controls from other frameworks that may serve as evidence, including ISO/IEC 27001. They fit together well.
ASD Essentials will replace ASD’s current maturity model, which organisations are still assessed against today, and many organisations already use those technical controls as practical evidence for Annex A controls such as vulnerability management, access control and backup. A well-run ISMS gives you the governance and evidence that both rely on.
Annex A includes controls for awareness training (A.6.3) and managing technical vulnerabilities (A.8.8), and penetration testing is a common way to evidence the second. Our security awareness training, vulnerability management and penetration testing services help you produce that evidence, as part of our wider cyber security services.
04The process
We review what you already have against the 2022 standard and agree a realistic scope.
We run the risk assessment, select controls, write the Statement of Applicability and draft the policies and procedures with your team.
We help you put the controls in place, from access control and supplier security to awareness training and incident management, and start keeping the records auditors look for.
We audit the ISMS internally, support your management review and help you close any findings.
We help you prepare for the Stage 1 and Stage 2 audits run by your chosen certification body, and support you through surveillance audits afterwards.
05Frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
| Control | ASD Essentials | ASD maturity model (current) | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|---|
| Information security policies | Governance and culture | Not applicable | A.5.1 | Govern (GV.PO-01) |
| Access control and authentication | Identity services | Multi-factor authenticationRestrict administrative privileges | A.5.15, A.8.2, A.8.5 | Protect (PR.AA-05) |
| Staff awareness and training | Governance and culture | Not applicable | A.6.3 | Protect (PR.AT-01) |
| Incident management process | Visibility and response | Not applicable | A.5.24, A.5.26 | Respond |
| Vulnerability management and backup | Not applicable | Patch applicationsPatch operating systemsRegular backups | A.8.8, A.8.13 | Identify (ID.RA-01); Protect (PR.DS-11) |
| Independent review and internal audit | Not applicable | Not applicable | A.5.35 | Identify (ID.IM-01) |
We run our own information security management system to the standard we help clients meet.
06Pricing
Pricing*
Quoted for your environment
What changes the price
Full implementation is quoted separately and depends on your scope, number of sites, existing documentation, how much of the work your team wants to do and whether you need ongoing support after certification.
Not included: the certificate itself. An independent certification body issues it after its own audits, and its fees are paid to it directly.
07FAQ
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistCertification follows a set sequence: gap assessment, ISMS design, implementation, then an internal audit and management review before the certification body's two-stage audit. The certification body needs to see the ISMS operating, with records, before Stage 2. How long each stage takes depends on your starting point, your scope and how much of the work your team takes on, so we plan the stages with you once the gap assessment shows where you stand.
No, and no consultant should. Certification is issued by an independent certification body after its own Stage 1 and Stage 2 audits. Our role is to build and prepare your ISMS so you are ready for those audits, then support you through them. Keeping the consultant and the auditor separate is what gives your certificate its credibility.
The 2022 version reorganised Annex A into 93 controls across four themes: organisational, people, physical and technological. It merged many older controls and added new ones, such as threat intelligence, information security for cloud services and secure coding. If your ISMS or Statement of Applicability still references the 2013 control numbers, it needs to be updated to the 2022 version.
It is worth it when customers, tenders or government buyers ask for it, or when you hold sensitive client data and need a structured way to manage risk. For a growing business, a well-scoped ISMS can be practical and proportionate. If no one is asking yet, starting with the technical controls ASD prioritises may be a better first step.
A Statement of Applicability (SoA) is the ISMS document that lists every ISO/IEC 27001:2022 Annex A control, says whether it applies to you, explains why, and describes how it is implemented. It links your risk assessment to your controls. Certification auditors rely on it heavily, so it must match what your organisation actually does.
Talk to our team
No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.
