ISO Certification Readiness
from a Team That Is
ISO Certified Itself
ISO audit and certification readiness
Build Management Systems That Pass Certification and Improve Your Business
iSpyCyber helps organisations implement and audit ISO management systems for information security, quality, privacy and business continuity. We are ISO/IEC 27001 and ISO 9001 certified ourselves, and we combine management system expertise with technical security testing so your controls are effective as well as documented.
Why organisations choose iSpyCyber
We have been through it
As an ISO/IEC 27001 and ISO 9001 certified company, we know what certification audits look for from the inside.
Integrated management systems
Shared clauses across ISO/IEC 27001, ISO 9001, ISO/IEC 27701 and ISO 22301 implemented once, reducing duplication.
Risk-based, not template-based
Risk assessments and statements of applicability built around your actual assets, threats and objectives.
Controls tested technically
Vulnerability assessment and penetration testing support Annex A technical controls with real evidence.
Independent internal audits
Internal audits under clause 9.2 carried out by qualified auditors, independent of the teams who built your controls.
Beyond the certificate
Support through surveillance audits and recertification, with management reviews and continual improvement.
Coverage
Standards and Requirements We Help You Meet
We cover the management system clauses common to ISO standards and the specific controls each one adds.
ISO/IEC 27001:2022
Information security management system clauses 4 to 10 and the 93 Annex A controls across organisational, people, physical and technological themes.
ISO 9001
Quality management system, customer focus, process approach, operational control and continual improvement.
ISO/IEC 27701
Privacy information management for controllers and processors, aligned with GDPR and the DPDP Act.
ISO 22301
Business continuity management, business impact analysis, continuity strategies, plans and exercising.
Context and scope
Interested parties, internal and external issues, scope statement and leadership commitment under clauses 4 and 5.
Risk and objectives
Risk assessment and treatment, statement of applicability and measurable objectives under clause 6.
Support and competence
Resources, competence, awareness, communication and documented information under clause 7.
Performance evaluation
Monitoring and measurement, internal audit and management review under clause 9.
Improvement
Nonconformity handling, corrective action and continual improvement under clause 10.
Methodology
A Six-Phase Path from Gap Assessment to Certification Audit
Aligned to the ISO harmonised structure and ISO 19011 auditing guidance, and tailored to the standards and scope you are certifying.
- ISO/IEC 27001:2022
- ISO 9001
- ISO/IEC 27701
- ISO 22301
- ISO 19011
3–6
months for a typical first certification
6
lifecycle phases
4
ISO standards supported
01
- Weeks 1–2
Scope and context
Standards, scope, locations and interested parties agreed with leadership.
Key activities
- Define the management system scope
- Identify interested parties and issues
- Confirm leadership roles and commitment
- Output: Scope statement and project plan
02
- Weeks 2–4
Gap assessment
Current practices assessed against every clause and applicable control.
Key activities
- Interview process and control owners
- Review existing documentation and records
- Rate gaps by risk and effort
- Output: Clause-by-clause gap report
03
- Weeks 3–7
Risk and design
Risk assessment, treatment plan and statement of applicability built around your context.
Key activities
- Build the asset and risk register
- Select controls and treatment options
- Prepare the statement of applicability
- Output: Risk register and statement of applicability
04
- Weeks 6–16
Implement
Policies, processes and controls put into operation, with technical testing of key safeguards.
Key activities
- Draft policies and procedures
- Awareness training for staff
- Vulnerability assessment and penetration testing
- Output: Operating management system
05
- Weeks 14–20
Internal audit and review
Independent internal audit and management review, with corrective actions closed before certification.
Key activities
- Full internal audit against the standard
- Facilitate the management review
- Track corrective actions to closure
- Output: Internal audit report and corrective action log
06
- Stage 1 and Stage 2
Certification support
Support through Stage 1 and Stage 2 audits by your accredited certification body.
Key activities
- Help select and brief the certification body
- Support during Stage 1 and Stage 2 audits
- Close any nonconformities raised
- Output: Surveillance and improvement plan
Effort distribution
Where the programme time goes
Most of the effort goes into building a management system your people actually operate. Percentages are indicative for a first ISO/IEC 27001 certification.
Quality built into every phase
Certified ourselves
We apply what we practise every day.
Independent internal audits
Auditors do not audit their own work.
Risk-driven controls
Controls chosen for your risks, not a template.
Nonconformities closed
Corrective actions are verified before certification.
Engagement options
Choose the ISO Support That Fits Your Stage
Whether you need an independent check, a full implementation or a trusted internal audit function, the methodology is the same.
Gap assessment
A review against every clause and applicable control of your chosen standard, with a prioritised roadmap. Best for planning a first certification or a transition to ISO/IEC 27001:2022.
Full readiness programme
Scoping, risk assessment, documentation, implementation, training, technical testing, internal audit and management review. Best for first-time or multi-standard certification.
Ongoing compliance support
Outsourced internal audits, management review facilitation, risk register updates and surveillance audit preparation. Best for certified organisations keeping their management system effective.
Not sure which option you need?
Our specialists will recommend an approach based on the standards you need, your scope and your target certification date.
Deliverables
A Management System Ready for Its Certification Audit
Clear priorities for leadership, workable processes for teams and the documented information your certification body will review.
Gap report
Status against each clause and applicable control, with gaps rated by risk and effort and an executive summary.
Policies and documentation
Policies, procedures, risk methodology, risk register and statement of applicability tailored to your scope.
Evidence packs
Records, internal audit reports, management review minutes and technical test results organised for auditors.
Remediation roadmap
A sequenced plan with owners and dates that brings you to Stage 1 readiness and beyond.
Integrated with the frameworks you already work to
- ISO/IEC 27001:2022
- ISO/IEC 27002
- ISO 9001
- ISO/IEC 27701
- ISO 22301
- ISO/IEC 27017
- ISO/IEC 27018
- SOC 2
- DPDP Act 2023
- GDPR
iSpyCyber provides ISO readiness, gap assessment, implementation, internal audit and technical testing. ISO certificates are issued only by accredited certification bodies, which must remain independent of those who implemented your management system.
ISO certification readiness for every industry
FAQ
ISO audit and certification questions, answered
Can’t find what you need? Talk to our security team.
The basics
Does iSpyCyber issue ISO certificates?
No. ISO certificates can only be issued by a certification body accredited to audit that standard. iSpyCyber prepares you for certification through gap assessment, implementation, technical testing and independent internal audits, and supports you during the Stage 1 and Stage 2 audits. Accreditation rules keep certification bodies independent from consultants who help build the management system.
What are Stage 1 and Stage 2 audits?
Stage 1 reviews your documentation and readiness. Stage 2 evaluates whether the management system is implemented and effective. Certificates are then maintained through surveillance audits and a recertification audit on a three-year cycle.
We are certified to ISO/IEC 27001:2013. What now?
The transition period to ISO/IEC 27001:2022 ended in October 2025, so certificates against the 2013 edition are no longer valid. If you have not yet moved, we can run a gap assessment against the 2022 edition and support you through recertification with your certification body.
Working with us
How long does ISO/IEC 27001 certification take?
Most organisations are ready for the certification audit in three to six months, depending on scope, size and existing controls. The certification body then runs Stage 1 and Stage 2 audits before making its decision.
Can you implement several ISO standards together?
Yes. ISO/IEC 27001, ISO 9001, ISO/IEC 27701 and ISO 22301 share a common high-level structure, so we implement shared clauses once and add each standard’s specific requirements as an integrated management system.
Can you act as our internal auditor?
Yes. Many clients outsource internal audits under clause 9.2 to us. We keep our auditors independent from the people who designed or operate the controls being audited.
Get started
Certify with Confidence.
Improve Long After the Audit.
Talk to our ISO specialists about a scoped readiness review for the standards your organisation needs.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries