Expertise · Framework
ISO 27001
The international standard for information security management. We design, implement, and run the ISMS — and take you to certification and beyond.
What it is, and why it matters.
ISO 27001 is the leading international standard for information security management. It isn't a checklist — it's a risk-based management system: you define a scope, assess your risks, select and implement appropriate controls, and run a continuous cycle of audit and improvement. Certification by an accredited body demonstrates — credibly, to customers, partners, and regulators — that your security is properly managed. It is increasingly a contractual requirement to win and keep business, and a strong foundation for other obligations: much of what NIS2 and similar regulations ask for maps neatly onto a working ISMS.
Who it affects.
Organisations that need to demonstrate information security maturity — to win business, satisfy client or regulatory requirements, or bring structure to a security function that has grown ad hoc. Common across technology and SaaS, professional services, healthcare, finance, and suppliers to government and large enterprises.
What it involves.
Defining the ISMS scope — which parts of the organisation, systems, and information it covers
Risk assessment and treatment
Selecting and implementing controls (Annex A), documented in a Statement of Applicability
Policies, processes, and records that make the system real
Internal audit and management review
Certification audit (Stage 1 and Stage 2), then ongoing surveillance audits
Sits under:
Compliance
ISO 27001 within your managed office.
ISO 27001 sits under Compliance and acts as the backbone for much of the rest of your program — its risk management, governance, and controls support NIS2, BIO2.0, and other obligations rather than duplicating them. We run it alongside everything else that applies to you, connecting Compliance with Governance and Risk.
How we help.
00
Scoping & gap analysis
A sensible ISMS scope and an honest read of where you stand today.
00
Risk assessment & treatment
A rigorous, repeatable assessment turned into a clear plan.
00
ISMS design & documentation
The management system, without drowning you in paper.
00
Control implementation
Organisational controls implemented; technical ones orchestrated via partners.
00
Internal audit & review
Audits and management reviews so the system actually improves.
00
Certification support
Preparation and support through Stage 1 and Stage 2 audits.
00
Ongoing maintenance
Kept alive and certification-ready year after year as your managed office.
Related expertise.
NIS2
The EU's updated cybersecurity directive expanded scope across 18 sectors, strict incident reporting, supply-chain security, and personal accountability for management.
BIO2
The information-security baseline for Dutch government — the successor to the BIO, aligned to ISO 27001/27002 and more strongly risk-based.
Risk Management
The living discipline of identifying, assessing, treating, and monitoring risk — aligned to your appetite, so you take the right risks knowingly.
TRUSTED BY ORGANISATIONS ACROSS EUROPE
