ISO 27001 Preparation: ISMS, Documents, Internal Audit

ISO/IEC 27001 Certification Preparation

ISO/IEC 27001 is the international standard for an information security management system (ISMS). We prepare your company for the certification audit: we build the ISMS, write the documents, run an internal audit and close the technical gaps ourselves. The certificate is issued by an independent accredited certification body.

Discuss preparationTelegramWhatsApp

In short

We work to the current ISO/IEC 27001:2022. Certificates to the 2013 version were valid until 31 October 2025.
In hand: the ISMS document set, a risk register, the Statement of Applicability (SoA), and an internal audit report.
We put the technical measures in place ourselves: access, MFA, backups, logging, updates.
We run our own ISMS built on ISO/IEC 27001:2022.
A fixed quote once the scope is agreed.

Who needs ISO 27001, and why

A large client or a bank sends a security questionnaire and asks about certification.
Your company bids for tenders that list ISO/IEC 27001 as a requirement.
You handle personal or financial data of clients in the EU, the US or Canada.
You want order: who is responsible for what, where the data lives, what happens during an incident.

What the standard requires

The mandatory part of the standard (clauses 4 to 10) describes the management system: ISMS scope, policy, risk assessment and treatment, objectives, competence, documentation, monitoring, internal audit, management review and continual improvement.

Annex A of the 2022 version lists 93 controls in four themes: organizational, people, physical and technological. A company selects the applicable controls from its risk assessment and justifies the selection in the Statement of Applicability (SoA).

What we do

Gap analysis. We compare your current state with the standard and list the gaps.
Scope and risks. We define the ISMS scope, run the risk assessment and write the risk treatment plan.
Documents. Policies and procedures written for your company, the risk register, the SoA.
Technical measures. We close the gaps ourselves or with your IT contractor: access, MFA, backups with a tested restore, logging, updates.
Internal audit. We audit the system against the standard and record what is left before certification.

How certification works

An independent accredited certification body runs the certification audit in two stages: first a review of documents and readiness, then a check of how the system works in practice. The certificate is valid for three years, with surveillance audits every year in between.

We prepare you for both stages and help close the auditor's findings.

What you get in hand

The ISMS document set: policies, procedures, risk register, risk treatment plan, SoA.
Technical measures in place, each one marked as done.
An internal audit report and a list of what is left before the certification audit.

Cost

A fixed quote once the ISMS scope is agreed: company size, number of sites and systems, and current maturity.

Who does the work

Security work is carried out by INNOVA CONSULT LTD., Corporation Number 1522612, Ottawa, Ontario (Corporations Canada). The team works from its own experience with strong tools, including Claude models, to find problems faster. A person checks every finding before it reaches the report. INNOVA CONSULT LTD has been approved for Anthropic's Cyber Verification Program (CVP), which lets verified organizations use Claude models for defensive cybersecurity work.

ISO 27001 questions

Do you issue the ISO 27001 certificate?

No. An independent accredited certification body issues the certificate after its audit. We prepare your company for that audit.

What is an ISMS?

An information security management system: the rules, roles, processes and controls a company uses to manage risks to its information.

What is a Statement of Applicability (SoA)?

A document that lists the Annex A controls, marks which ones apply and why, and which are excluded and on what grounds.

How many controls does ISO/IEC 27001:2022 have?

93 controls in four themes: organizational, people, physical and technological.

Is an ISO/IEC 27001:2013 certificate still valid?

The transition period ended on 31 October 2025, and 2013-version certificates are no longer valid after that date. Certification now runs against the 2022 version.