02 / Compliance and certification
ISO/IEC 27001, built to survive the audit and the year after it
We help you scope, build and run an information security management system that an accredited certification body can audit, and that your teams can actually live with.
Overview
What ISO/IEC 27001 asks of you
ISO/IEC 27001 is the international standard for an information security management system (ISMS): a defined scope, a risk assessment, controls chosen to treat those risks, and evidence that the whole thing runs.
We start from how your organisation already works, not from a template. Policies, risk treatment and the Statement of Applicability are written around your real processes, so the system keeps running once the consultants have left.
Certification itself is issued by an accredited certification body, independent of the team that helped you implement. We work with long-standing certification partners and coordinate the audit with them, or with a body of your choice, so you go from gap analysis to the certificate in one engagement. Black Fox sits beside you during the audit if you want us there, and helps you keep the certificate through surveillance audits.
Who it is for
Organisations whose clients, tenders or regulators ask for ISO/IEC 27001, and teams who already have controls in place but no management system around them. It is also a solid base for NIS2 and DORA obligations.
The work, from scoping to evidence.
What we do
Scope and context
We define the ISMS scope, interested parties and boundaries, so the audit covers what matters to your clients and nothing you cannot defend.
Gap assessment
A clause-by-clause and Annex A review of where you stand today, with findings ranked by risk and effort.
Risk assessment and treatment
A risk method that fits your size, a risk register your owners understand, and a treatment plan tied to the controls you choose.
Statement of Applicability
Every Annex A control considered, with a justified decision to include or exclude it, and a pointer to its evidence.
Policies and procedures
Documents written for the people who follow them, integrated with ISO 9001, ISO 22301 or other management systems where you already run them.
Internal audit and management review
An internal audit independent of the people who built the controls, and a management review that produces decisions, not minutes.
How the engagement runs
Kickoff
We agree the scope, the people involved and the constraints, and sign an NDA first if you need one.
Gap assessment
Interviews, document review and sampling of evidence, ending in a prioritised gap report.
Implementation support
We work with your owners to close the gaps: risk assessment, controls, documents and evidence.
Internal audit
A full internal audit against the standard, run like the real one, with nonconformities you can still fix.
Certification audit
We coordinate the audit with one of our long-standing certification partners or the accredited body of your choice, help you prepare for stage 1 and stage 2 and help with any findings that follow.
Keeping it
Optional ongoing support through surveillance audits and recertification, so the ISMS does not decay between visits.
What you receive
- ISMS scope statement and context analysis
- Gap assessment report with a prioritised action plan
- Risk register and risk treatment plan
- Statement of Applicability with evidence references
- Policy and procedure set fitted to your organisation
- Internal audit report and management review inputs
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Do you issue the ISO/IEC 27001 certificate?
No. Certificates are issued by accredited certification bodies, and the body that certifies you must be independent of the people who helped you implement. We prepare you, coordinate the audit with one of our long-standing certification partners or a body of your choice, support you during it and help you keep the certificate.
Do we have to implement every Annex A control?
No. You must consider every Annex A control and decide, based on your risks, which ones apply. The Statement of Applicability records each decision and the justification for it.
What is the difference between ISO/IEC 27001 and ISO/IEC 27002?
ISO/IEC 27001 sets the requirements for the management system and lists the controls in Annex A. ISO/IEC 27002 is guidance on how to implement those controls. You certify against 27001; 27002 helps you do it well.
How long does it take?
It depends on the scope, how much is already in place and how quickly your team can respond. After the gap assessment you get a dated plan instead of a guess.
Related services
- Compliance and certificationISO/IEC 27701ISO/IEC 27701 support from Black Fox Security: PIMS scoping, controller and processor roles, privacy risk, records of processing and certification preparation.
- Compliance and certificationNIS2NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
- Managed securityContinuous complianceContinuous compliance from Black Fox Security: evidence calendar, internal audits, control testing, policy reviews and surveillance audit support.
Start with an honest gap assessment
Tell us about your scope and your deadline. We will tell you what stands between you and the audit.