Standaard
EUR 6,000Six months. The steady pace.
Start this engagementReadiness engagement
ISO 27001 readiness
We build your information security management system to ISO 27001 and prepare you for the certification audit: scope, policy, risk assessment, Statement of Applicability, procedures and evidence.
Deliverables
What you get
Seven deliverables, written for your organisation and kept in your client portal.
- 01The scope of your management system: systems, services, locations and teams
- 02An information security policy, roles and objectives (clauses 4 to 6)
- 03A risk assessment and a risk treatment plan
- 04A Statement of Applicability against the 93 Annex A controls
- 05Practical procedures for the controls you actually need
- 06Evidence collected against every control, in your client portal
- 07An internal audit, a management review, a summary of open points and the handover to your certification body
Method
How it runs
- Phase 1
Kick-off
Confirm the scope and list the systems, services and teams it covers.
- Phase 2
Foundations
Policy, roles, objectives and the risk method: clauses 4 to 6.
- Phase 3
Risks and controls
The risk assessment, the treatment plan and the Statement of Applicability.
- Phase 4
Evidence
Your team uploads evidence against each control in the portal; we review it.
- Phase 5
Internal audit and management review
Done by someone not involved in the earlier phases, as the standard requires.
- Phase 6
Audit readiness
A summary of open points and the handover to your certification body.
Price
Three paces, one set of deliverables
The certification body's audit fee, typically EUR 6.000 to 12.000, is paid by you to them. It is never part of my price.
Versneld
EUR 9,000Four months. A customer has set a date.
Start this engagementSpoed
EUR 12,000Three months. Everything at once.
Start this engagementQuestions
Asked before ordering
Who does the certification audit?
An accredited certification body that you choose and contract. We prepare you; we never audit what we advised.
Do we have to implement all 93 controls?
No. The Statement of Applicability records which controls apply to your risks and why the others do not.
How do we pay?
Half when you order and half at the certification-audit milestone. Online payment opens once the company's payment account is live.