Security · Compliance & Audit Readiness · 01
ISO/IEC 27001 readiness
ISO/IEC 27001 readiness prepares an organization to pass a certification audit against the standard for information security management systems: the scope, the risk assessment, the Statement of Applicability, the Annex A controls, the management reviews and the records that show the system operates. It is needed when a customer or market requires the certificate, when a first certification is planned, or when a surveillance or recertification audit is approaching and the system has drifted. Readiness produces a gap assessment against every clause and applicable control, the documentation set written to the organization’s actual practice, the evidence the auditor will sample, and an internal audit and management review completed before the certification body arrives.
Scope
What the review covers.
- Scope definition and the information security management system boundaries
- Risk assessment method, risk register and risk treatment plan
- Statement of Applicability and the Annex A controls selected
- Policy and procedure set, written to actual practice
- Records: management review, internal audit, training, incidents, supplier reviews
- Readiness check against the certification body’s stage 1 and stage 2 expectations
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Gap assessment | Clause by clause and control by control, with evidence status |
| Documentation set | Policies, procedures, Statement of Applicability, risk register |
| Evidence pack | Organized for the auditor’s sampling |
| Internal audit and management review | Completed and recorded before certification |
| Audit support | Available during stage 1 and stage 2 |
Prerequisites
What we need from you.
- Decision on the certification scope and the certification body, or support choosing them
- A management sponsor and an internal owner for the system
- Access to existing policies, risk records and control evidence
Related
Where this sits.
- Compliance & Audit Readiness Service
- Security Hub
- CMMC readiness Also
- NIST SP 800-171 gap assessment Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
How long does readiness take?
It depends on the starting point and the scope. An organization with working controls and little documentation moves faster than one with documentation and few working controls.
Do you perform the certification audit?
No. Certification is performed by an accredited body. We prepare you for it and support you during it, and our independence from the certifier is part of the value.
Can the system be kept small?
Yes. Scope discipline is the single biggest factor in a manageable system. We scope to what the business needs certified.