Cyber Correlate

Englishالعربية Soon
Under attack?
ISO/IEC 27001:2022

Certification is a byproduct. The management system is the point.

We take you from gap analysis to certificate: scope, risk, controls, documentation, internal audit and audit support. Built to pass, and built so it still works the year after nobody is watching.

What determines your timeline
How wide you set the scope
Whether processes are already documented
Whether controls exist or only exist on paper
How quickly evidence can be produced
Your certification body’s availability

Typical programme: three to six months for an organisation with documented processes. We tell you which case you are after the gap analysis, with a realistic certification date rather than an optimistic one.

Programme

Nine months, laid out honestly

Workstreams overlap deliberately. Waiting for documentation to finish before implementing controls is what turns a six-month programme into eighteen.

Workstream
Months 1 to 9
What it produces
Gap analysis & scope
Month 1 to 2
Current state against every clause and control, and the scope decision that determines the cost of everything after it.
Risk assessment & treatment
Month 2 to 4
A repeatable methodology, an assessment your team can rerun, and a treatment plan with owners and dates.
Statement of applicability
Month 3 to 4
Every control addressed with a decision and a justification, in the form the auditor expects.
Policies & procedures
Month 3 to 5
The policy set written for your organisation, in language your staff will actually follow.
Control implementation
Month 4 to 7
Technical and organisational controls implemented or specified, with evidence collection built in.
Awareness & training
Month 5 to 7
Staff trained on their obligations, and the training recorded, because the auditor asks for the register.
Internal audit & review
Month 7 to 8
A full internal audit and management review, with findings closed before the certification body arrives.
Stage 1 & stage 2 audit
Month 8 to 9
We are present for both, handle auditor questions and manage findings through to closure.
Annex A

93 controls, four themes, and a justification required for every one

The 2022 revision reorganised the controls into these four themes. You must state a decision on all of them, including the ones you exclude.

37
Organisational

Policies, roles, supplier relationships, cloud services, threat intelligence, business continuity and the governance clauses auditors probe first.

8
People

Screening, terms of employment, awareness, disciplinary process and remote working, the controls that live with HR, not IT.

14
Physical

Perimeters, entry, equipment, clear desk, storage media and secure disposal, including your branch offices and data centre.

34
Technological

Access control, cryptography, secure development, logging, monitoring, malware protection, data leakage and network security.

Exclusions are where certification attempts most often come apart. Ours are documented against the risk assessment, which is the only defence an auditor accepts.
Deliverables

What you keep when we leave

Every item below is a document or a running process you own, not a slide in a closing presentation.

✓Gap analysis report against every clause and control
✓Documented and justified scope statement
✓Risk assessment methodology your team can rerun
✓Risk register with owners, ratings and dates
✓Risk treatment plan mapped to controls
✓Statement of applicability with justifications
✓Full policy set and supporting procedures
✓Control implementation evidence and records
✓Awareness training material and completion register
✓Internal audit report and closed findings
✓Management review minutes and inputs
✓Stage 1 and stage 2 audit support and findings closure
Beyond certification

After the certificate

A certificate is valid for three years with surveillance audits in between. We can run the internal audit cycle, maintain the evidence and attend the surveillance audits, or hand the whole system to your team with the training to keep it.

vCISO and ISO as a service →

Beyond certification

If you already failed one

We are frequently called in after a first attempt stalls. The cause is almost always scope set too wide, exclusions that cannot be justified, or evidence that was produced for the audit rather than by the business.

Talk to a consultant →

Related

Standards clients usually pursue alongside it

PCI DSS and PCI-S3

Overlapping evidence, different scope. Run together they cost far less than sequentially.

Risk assessment

The register is the backbone of the management system, not an annex to it.

Central Bank regulations

For regulated institutions, certification is usually the vehicle for demonstrating compliance.

Start with the gap analysis.

Two weeks, a defined scope recommendation, and a certification date you can put in front of your board.