A client or tender is asking for ISO 27001 and the audit date is coming. We help you build an information security management system that holds up in the certification audit: scope, risk assessment, Statement of Applicability, policies and the technical controls behind them.
A deal or tender depends on ISO 27001 and nobody internally has done it before.
Auditors need evidence: approved policies, records and proof that controls run.
Without a solid risk assessment the Statement of Applicability turns into guesswork.
Gaps in mandatory clauses, like the internal audit or management review, can hold up certification.
Start with the gap assessment, or pick the part you need. You decide how much we take on.
Find out exactly where you stand against ISO 27001:2022 and what it will take to get certified.
We build the management system with you, and help with the technical controls where you want us to.
Make sure the system holds up before the certification body arrives.
We agree a sensible ISMS scope and measure where you stand against every requirement.
A risk assessment you can repeat, a treatment plan and a justified decision for every Annex A control.
Policies that match reality, technical controls that work, and evidence collected in your client portal.
Internal audit, management review and support through the certification body's Stage 1 and Stage 2 audits.
We cover servers, cloud, networks, databases and security, so the controls in your policies actually exist in your systems.
Your controls, status, evidence files and open actions in one place — ready for the auditor and for every surveillance audit after.
We're not a certification body and don't issue certificates. We prepare you for an accredited one — properly.
Ten questions on what certification auditors look at first. Answer them and get a personalised PDF report by email: your indicative score, your priority gaps and what to do about each.
Give us a few details about you and add your email to receive your personalised ISO 27001 readiness report as a PDF: your indicative score, your priority gaps and what to do about each.
Indicative only — this is not an audit or a certification. Your answers are sent to us only when you request the report.
Also in scope of NIS2? ISO 27001 and the DNSC NIS2 controls cover much of the same ground — risk management, policies, access control, incidents, suppliers and continuity. We can build one management system that serves both, so you don't do the work twice. An ISO certificate doesn't replace the DNSC self-assessment, though. See our NIS2 readiness service →
No. ISO 27001 certificates are issued by certification bodies accredited for information security management systems — in Romania, by RENAR. We prepare you for that audit: scope, risk assessment, Statement of Applicability, policies, technical controls and evidence. We can help you choose an accredited certification body.
It depends on your scope, your size and what is already in place. A focused scope with good technical foundations moves much faster than a company starting from zero. The gap assessment gives you a realistic plan and effort estimate before you commit to anything else.
No. Your risk assessment decides which controls you need. The Statement of Applicability lists all 93 Annex A controls and records, for each one, whether it applies, why, and whether it is implemented. Exclusions are allowed when you can justify them.
Not by law in general. Companies usually pursue it because clients, partners or tenders ask for it. For companies in scope of NIS2, ISO 27001 covers much of the same ground, but it does not replace the DNSC self-assessment.
The certification body runs a Stage 1 audit (mainly your documentation and readiness) and a Stage 2 audit (whether the system works in practice). Certificates run on a three-year cycle, with surveillance audits in the years between and a recertification audit at the end.
What the standard requires, the 93 Annex A controls, the documents auditors ask for, how certification works in Romania and how ISO 27001 compares with NIS2 and SOC 2 — in plain English, with sources.
Read the full ISO 27001 guide →A 30-minute call to understand your situation, your deadline and what you need. No sales pitch.