Pre-audit
We assess the current state against the ISO 27001 requirements and Annex A controls, showing what is already in place and what is missing.
ISO/IEC 27001
ISO 27001 preparation – to the certification audit without surprises
We build an information security management system with you that meets ISO/IEC 27001 requirements and also works in everyday operations. From the pre-audit and risk analysis to documentation and representing you at the audit.
Who it is for
Who this service is for
- Companies whose client, partner or public tender requires an ISO 27001 certificate
- Organisations that have started with ISO 27001 but got stuck on documentation or risk analysis
- Managers who want to know the realistic timeline, scope and cost before deciding
- Companies that want an independent readiness check before the certification audit
What is included
What the service includes
Creating a roadmap
A prioritised plan with a timeline: what to do first, what second, and who is responsible for each part.
Risk analysis
We create, or help you create, the risk assessment methodology, risk register and risk treatment plan that will hold up in an audit.
Developing procedures
Policies, procedures and guidelines – we write them or support your team in creating them. Not a pile of paper, but documents that actually get used.
Internal audit and management review
The standard requires both. We run the internal audit and prepare the management review so leadership actually gets decision-ready information.
Representation at the certification audit
We are beside you during the audit: helping answer the auditor's questions, find evidence and handle any non-conformities.
Process
How we work
Kick-off and scope
We agree which units, services and systems fall under certification. Scope determines the size of the whole project.
Pre-audit and gap analysis
We review existing documentation and practice and record every gap together with its impact.
Roadmap and priorities
You get a concrete action plan with owners and deadlines – in language management understands.
Implementation
Risk analysis, documentation and putting controls in place. We work with your people, not instead of them.
Internal audit and management review
We check whether the system works and fix the gaps before the auditor finds them.
Certification audit
The certification body's stage 1 and stage 2 audit, where we stand beside you and help with the follow-up actions.
Outcome
What you end up with
- A documented information security management system (ISMS)
- Risk assessment methodology, risk register and risk treatment plan
- Statement of Applicability (SoA)
- Internal audit report and management review minutes
- A clear picture of where you stand in relation to the certification audit
FAQ
Frequently asked questions
How long does ISO 27001 preparation take?
It depends on the size of the company, the scope, and how much is already documented. Preparation typically takes between a few months and about a year. Within the first few weeks, the pre-audit shows how much work is needed in your case.
Do you issue the certificate as well?
No. The certificate is issued by an independent accredited certification body – a requirement that keeps the certificate credible. Our role is to prepare you, run the internal audit and stand beside you during the audit.
What is the difference between ISO 27001 and E-ITS?
ISO 27001 is an international management system standard that can be certified. E-ITS is the Estonian information security standard, mandatory for organisations performing public duties, and built on baseline protection logic. They are compatible – if you have one, you are not starting from zero with the other.
Does ISO 27001 cover the Cybersecurity Act (NIS2) requirements?
A certificate is not automatic legal compliance, but a management system built to ISO 27001 covers a large part of the risk management, incident handling and management accountability requirements. In practice it makes meeting the legal obligations considerably easier.
Does the company need to be a certain size?
No. ISO 27001 scales – a small company's management system is simply smaller and simpler. What matters is that it matches your risks, not that it is voluminous.
Is your ISO 27001 project realistic?
Get in touch and we will talk through your scope, timeline and what is already in place. Afterwards you will have a clear picture of how much work lies ahead.
See also
Related services
Information security audit and assessment
Independent assessment and an audit-readiness check.
Read more →Information security manager (CISO) as a service
Professional information-security leadership as a service – for companies that don't need a full-time security manager.
Read more →ISO 9001 quality management system
Building a quality management system and preparing for certification.
Read more →