ISO/IEC 27001 Certification
ISO 27001 is the standard most people mean when they say "we need a real information security management system." It doesn't hand you a fixed checklist of technical controls — it asks you to build a management system: understand your risks, decide deliberately how you're going to treat them, pick controls from Annex A (or elsewhere) that actually address them, and then run the whole thing as an ongoing cycle of monitoring, internal audit, and improvement rather than a project with an end date.
Where the real work is
The part of ISO 27001 that trips people up isn't usually the controls themselves — it's the risk assessment and the Statement of Applicability that's supposed to flow from it. I've seen plenty of SoAs that were filled out by copying a template and marking most controls "implemented" without anyone actually tracing the logic from a specific risk to a specific control to specific evidence. An auditor will find that gap immediately, and more importantly, it means the ISMS isn't actually managing your real risks.
How I run this
I start with a risk assessment that reflects your actual environment — your data, your architecture, your threat landscape — not a generic industry list. From there, the Statement of Applicability becomes a real document: each control decision tied back to a specific risk, with a clear rationale for anything excluded. Then we build out the management system itself: policies that describe what you actually do, defined roles and responsibilities, an internal audit program, and management review that genuinely looks at whether the ISMS is working, not a rubber-stamp meeting.
If you're pursuing certification, I help you get ready for both stages of the external audit — the documentation review and the operational audit where the assessor checks whether reality matches the paperwork. If you're building an ISMS for its own sake rather than the certificate, we build to the same standard of rigor.
Who this is for
Companies that need ISO 27001 certification to win enterprise or international business, organizations formalizing a security program that's grown past ad hoc policies, and teams that tried this once with a template-driven approach and know it didn't really stick.
If you're starting an ISMS from scratch or trying to fix one that's not holding up, let's talk.