Service · ISO 27001 (technical controls)
ISO 27001: we build the technical controls.
An ISO 27001 ISMS has a management-system half (policies, risk methodology, the Statement of Applicability) and a technical-controls half. We do the technical half - the Annex A technological controls, a security gap assessment, and the testing that proves they hold. The certificate is issued by an accredited body you retain; we are not a certification body and take no referral fee.
What we do
Which ISO 27001 Annex A controls do we implement?
The engineering half of an ISMS - the controls an auditor actually inspects on the technical side.
Technical gap analysis
Current-state assessment against the technological Annex A controls (ISO 27001:2022). Output: a remediation backlog ranked by risk and effort.
Technical risk input
Asset inventory and threat modeling on the systems side, feeding the risk register your ISMS needs. The formal risk methodology + Statement of Applicability sit with your GRC lead; we supply the technical reality.
Control implementation
MFA, SSO, encryption in transit and at rest, centralized logging and monitoring, change management, and a secure SDLC.
Vulnerability management & VAPT
Penetration testing plus continuous scanning (Vexta) - the technical vulnerability-management evidence an auditor expects to see operating.
Control documentation
Clear write-ups of the technical controls and how they map to Annex A, so your auditor and GRC lead can slot them into the ISMS.
Technical auditor support
We answer the security-control questions and help show the technical evidence during stage-1 and stage-2 fieldwork, alongside the certifier you retain.
ISO 27001 implementation: the whole journey, and who does what
Getting certified takes more than security controls, and it involves three parties: you (or an ISMS consultant), a technical team like us, and an accredited certification body. This is the usual order:
| Step | What happens | Who |
|---|---|---|
| 1. Scope and context | Decide which business units, locations and systems the ISMS covers. | You or your ISMS consultant |
| 2. Risk assessment | Identify and rate information security risks, and choose how to treat each one. | You, with technical input from us |
| 3. Statement of Applicability | Record which Annex A controls apply, and why any do not. | You or your ISMS consultant |
| 4. Technical controls | Access control and MFA, encryption, logging and monitoring, vulnerability management, secure development, backups. | Us |
| 5. Policies and people controls | Policies, training, supplier management, HR and physical controls. | You or your ISMS consultant |
| 6. Testing | Penetration testing and scanning that prove the technical controls work. | Us |
| 7. Internal audit and management review | An independent check of the whole ISMS, then a leadership review of results. | Someone independent of the work, then your leadership |
| 8. Certification audit | Stage 1 (documentation and readiness), then Stage 2 (is it working?). | An accredited certification body you choose |
| 9. Keeping it | Surveillance audits in each of the next two years, and recertification every three years. | The certification body, with evidence from you and us |
How long is the certification audit?
Certification bodies size the audit from ISO/IEC 27006-1:2024 (Table C.1), based mainly on how many people work within the scope. As a rough guide, it starts at about five audit days for under ten people and rises to fourteen or more around 200 people. Bodies quote per audit day, so ask each one for its day count when you compare quotes. Work through your own numbers in the ISO 27001 cost estimator, or read what certification costs and how long it takes.
Which edition?
ISO/IEC 27001:2022, with its 2024 climate amendment, is the current certifiable edition. The deadline for moving certificates off the 2013 edition passed on 31 October 2025. ISO/IEC 27000:2026, published in 2026, is the vocabulary standard and is not something you certify against.
What we own vs. what stays with you
How we scope it
How do we scope the ISO 27001 technical work?
Sized to your current security maturity after a short scoping call.
Assess
Technical gap analysis against the technological Annex A controls. You get a ranked control backlog.
Implement
We build and harden the technical controls - access, encryption, logging/monitoring, vulnerability management, secure SDLC.
Test
Penetration testing and scanning to confirm the controls hold and to produce technical evidence.
Support fieldwork
We stand alongside you on the technical questions while your chosen accredited body runs stage 1 and stage 2.
ISO 27001 FAQ
Do you do the audit, or issue the certificate?
What exactly do you do vs. not do?
What does it cost?
How does this relate to SOC 2?
Further reading
Read more about ISO 27001
Navigating SOC 2 and ISO 27001 with a vCISO, Not a Full Security Team
SaaS founders facing enterprise deal security requirements can achieve SOC 2 or ISO 27001 compliance efficiently using a vCISO, avoiding the cost and time of building an in-house security team. A vCISO provides expert guidance, strategy, and audit support.
ISO 27001 Internal Audit: Who Can Perform It and What Certification Auditors Check
Preparing for your ISO 27001 Stage 2 audit? Your internal audit is critical. This guide explains who can conduct it and what your certification auditor will scrutinize.
What ISO 27001 Certification Actually Costs and Takes for Small Teams
What ISO 27001 certification costs a small company, line by line: how certification bodies set audit days, what is optional, whether you need a pentest, and a realistic timeline.
ISO 27001 vs SOC 2: Which Certification to Pursue First?
Deciding between ISO 27001 and SOC 2 for your SaaS company depends on your market focus and strategic goals. This guide provides a direct comparison to help you prioritize your compliance efforts.
Why UK and EU Enterprises Demand ISO 27001 from Vendors
UK and EU enterprise buyers prioritize ISO 27001 certification from vendors primarily because it provides a globally recognized, auditable framework for managing information security risks. This certification demonstrates a vendor's commitment to robust security, essential for mitigating supply chain risks and ensuring compliance with stringent data protection regulations.
Vulnerability Management: From CVE Avalanche to Actually Patched
Related: ISO 27001 cost estimatorSOC 2 readinessvCISO services
Next steps
Pick the next step.
Pick whichever fits how far along you are - we will meet you there.
Run a free website scan
Point it at a website you own and get a findings summary - no sales call needed.
Get a quote
Four short fields below. A fixed quote back within one business day.
Book a call
30 minutes, no deck, no pre-qualification. Bring the actual problem.
Get a quote
Four fields. A fixed quote within one business day.
No sales call required to get a number. Tell us what triggered this and when you need it by, and we will come back with a fixed price for ISO 27001 readiness.
ISO 27001 on your roadmap?
Let's scope the technical-controls work. The ISMS and the certificate stay with you and your accredited body - we make the technical side solid.