ISO 27001, built and run by a practitioner
Build an Information Security Management System that holds up under audit, led by a senior practitioner instead of a bench of junior consultants.
What you get
Annex A 2022 control set
All 93 controls in the latest version, mapped to what you actually run.
ISMS built for you
Risk register, statement of applicability, and policies, written for your business, not pulled from a generic template.
Surveillance audit ready
A repeatable evidence process makes year 2 and year 3 audits far less painful.
Multi-framework reuse
Controls and evidence organized once, reused for SOC 2 and ISO 27001 at the same time.
Risk treatment ownership
Decisions, mitigations, and owners tracked and driven to closure, not left in a spreadsheet.
Stage 1 and Stage 2 prep
Gap analysis and readiness work for both audit stages, plus liaison with your certification body.
Frequently asked
How is ISO 27001 different from SOC 2?
ISO 27001 is process driven and globally recognized. SOC 2 is evidence driven and dominant in North America. Many startups end up doing both.
How long does certification take?
4 to 12 months for most startups, depending on size and existing security maturity.
Do I need a separate ISMS document?
Yes. We build it from your actual environment and policies, then keep it current as your business changes.