ISO/IEC 27001:2022
ISO 27001 consulting: a practical ISMS, certified
We help you design, implement and certify an information security management system that fits how your company actually works — and that also prepares you for NIS2.
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- Annex A · 93 controls
- NIS2 Art. 21
- EU company · Estonia
- 15+ years in cybersecurity
- ECSO member network
- Certified ethical hackers
- Remote across the EU
Why ISO 27001
The security standard your clients already ask for
ISO/IEC 27001 is the international standard for information security management. Certification shows clients, partners and regulators that you manage information risk systematically — and it is increasingly a requirement in enterprise sales and public tenders.
- Win and retain enterprise clients that require certified suppliers
- Answer security questionnaires once, with evidence
- Build the governance backbone for NIS2 and DORA compliance
- Reduce incidents through clear processes, roles and controls
Roadmap
From gap analysis to certificate
Gap analysis
We assess your current practices against ISO 27001 clauses and Annex A controls and define the scope.
Risk assessment
We identify information assets, threats and vulnerabilities and agree a risk treatment plan.
Implementation
Policies, procedures, Statement of Applicability and technical controls — proportionate to your size.
Training & internal audit
Awareness for staff, an independent internal audit and a management review.
Certification
We support you through Stage 1 and Stage 2 audits with an accredited certification body.
Scope of work
What our ISO 27001 consulting includes
CLAUSES 4–6
ISMS design
Scope, context, information security policy, roles and objectives aligned with your business.
ANNEX A
Annex A controls
Selection and implementation of the 93 controls across organisational, people, physical and technological themes.
EVIDENCE
Documentation
Lean, usable documentation: Statement of Applicability, risk register and the procedures auditors expect.
TESTING
Technical validation
Our pentesters verify that technical controls work — not only that they are documented.
NIS2
Integration with NIS2
We map ISO 27001 controls to NIS2 Article 21 so one programme covers both.
AFTER CERTIFICATION
Ongoing support
Surveillance audits, continual improvement and the option of an ongoing CISO as a Service.
FAQ
Frequently asked questions
How long does ISO 27001 certification take?
For a mid-sized company, typically 6–12 months from gap analysis to certificate, depending on scope, existing controls and the time your team can dedicate.
How much does ISO 27001 cost?
Costs depend on scope, number of sites and maturity. They include consulting, any technical improvements and the certification body’s audit fees. After the gap analysis we provide a fixed proposal.
Is ISO 27001 the same as NIS2 compliance?
No, but they overlap heavily. ISO 27001 provides the management system and most of the controls NIS2 requires. NIS2 adds specific obligations such as incident reporting deadlines and management accountability.
We are certified to ISO 27001:2013. Do we need to transition?
Yes. The transition period to the 2022 version ended on 31 October 2025, so certificates must now be issued against ISO/IEC 27001:2022.
Do you issue the certificate?
No. Certification is granted by an independent accredited certification body. We prepare you and accompany you through the audits — this independence is what gives the certificate its value.
Next step
Ready to get certified?
Start with a gap analysis and a clear roadmap to ISO 27001.